77 Malicious Extensions Found on Open VSX Marketplace Harvesting Developer Data
Researchers discovered 77 malicious extensions on the Open VSX marketplace impersonating legitimate developer tools to harvest sensitive information from developers' systems and environments.
Security researchers have uncovered a campaign involving 77 malicious extensions distributed through the Open VSX marketplace. These extensions, disguised as legitimate developer tools, were found to be exfiltrating sensitive information from developers' systems and development environments. The campaign, dubbed "evil twin" by Manifold Security, operated between July 26 and August 1, 2026, with all malicious packages linked by a shared data-exfiltration domain and consistent code and network behaviors.
While 58 of the extensions collected only minimal system information, the remaining 19 exhibited more extensive reconnaissance capabilities. These more sophisticated versions exfiltrated data related to developers, Git repositories, and continuous integration (CI) environments. However, researchers noted that the extensions did not access source code, credentials, authentication tokens, SSH material, or browser data, leaving the ultimate purpose of the campaign open to speculation.
The "evil twin" tactic involves creating counterfeit packages that mimic the identity of legitimate extensions to deceive users into installing them. In this instance, the malicious packages reused the names, namespaces, and descriptions of real Open VSX extensions but were published under unrelated accounts. Most were assigned a low version number (0.0.1), and their bundled extension.js files were replaced with malicious code designed primarily for data collection and transmission.
According to Manifold Security, these extensions failed to provide the advertised functionality. Instead, they would display a status bar indicator or message confirming they were active before transmitting collected data to the attacker's server. The impersonated extensions covered a wide array of technologies and organizations, including prominent names like AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and even a U.S. government agency namespace.
All 77 malicious extensions communicated with a server located at mangorbit[.]com, which was registered just eleven days before the first malicious packages appeared on the marketplace. Most samples contacted subdomains like pulse.mangorbit[.]com or pulse2.mangorbit[.]com, while others utilized api.mangorbit[.]com or randomized subdomains under cb.mangorbit[.]com. Each package included a unique tracking identifier, enabling the operator to distinguish which counterfeit extension had been installed on a given system.
The 58 extensions with less extensive payloads primarily exfiltrated the machine's hostname, with some variants also sending the workspace folder name and editor version. The more advanced 19 extensions collected a significantly larger dataset approximately four to five seconds after activation. This included the operating system username and hostname, machine identifier, editor name and version, platform architecture, locale, timezone, and the name and full filesystem path of the currently open workspace. They also inspected files within the workspace's .git directory to gather Git remote hosts and organizations, the developer's configured email domain, the current branch, and the HEAD commit hash.
Furthermore, these 19 extensions enumerated up to 60 installed extensions and collected identifiers from various CI and cloud development environments, such as GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, GitHub Codespaces, and Gitpod. Unusually, the Open VSX listings for these extensions disclosed the collection of "anonymous usage metrics" and stated they did not access source code or credentials. However, Manifold reported that the extensions transmitted more data than disclosed, including CI information that could reveal private repository names or paths. Some variants even checked their installation method (manual vs. automatic project configuration) and were designed to attempt data transmission for up to seven days, supporting multiple collection endpoints and capable of querying DNS TXT records for replacement URLs.
The malicious packages were removed from the Open VSX marketplace by August 3, 2026. However, affected developers must manually remove the extensions from their systems and applications. Manifold recommends that users check their systems and workspace configuration files for the extension IDs listed in their report and block the mangorbit[.]com domain to mitigate further risk.