The Open VSX marketplace has recently identified and removed 77 malicious extensions that impersonated legitimate developer tools while covertly collecting and transmitting data from users’ systems and development environments. These deceptive extensions, often referred to as “evil twins,” were uploaded between July 26 and August 1, 2026, and were taken down by August 3, 2026.
Security researchers from Manifold Security discovered that these extensions were designed to exfiltrate various pieces of information. In 58 of the cases, the extensions transmitted basic details such as the machine’s hostname. However, 19 of the extensions went further, gathering comprehensive data including the local hostname, operating system username, editor’s name and version, machine ID, platform and architecture, locale and timezone, as well as details about the open workspace’s folder name and full file system path.
Notably, these malicious extensions replicated the names, namespaces, and descriptions of genuine Open VSX extensions but were published through unrelated accounts and assigned low version numbers, such as 0.0.1. The primary alteration involved modifying the bundled “extension.js” file to include code that captured and transmitted data under the guise of collecting “anonymous usage metrics.” Importantly, these extensions did not provide the functionalities they advertised. Instead, they displayed a status bar item indicating activation before initiating the data exfiltration process.
All 77 extensions transmitted the collected data to the domain “mangorbit[.]com,” which was registered on July 15, 2026, just days before the first of these extensions were published. Further analysis revealed that the malicious code included mechanisms to query a DNS TXT record to retrieve a fallback exfiltration URL, ensuring data collection could continue even if the primary domain was blocked or taken down. Additionally, the more advanced variants featured retry mechanisms that would reattempt data collection if initial attempts failed.
This incident underscores the persistent threats within software supply chains, particularly in open-source repositories like Open VSX. Developers are advised to exercise caution when installing extensions, especially those with low version numbers or from unfamiliar publishers. Regularly reviewing and updating installed extensions, along with monitoring for unusual activities within development environments, can help mitigate the risks associated with such malicious campaigns.
As the landscape of software development continues to evolve, the importance of vigilance in maintaining the integrity of development tools cannot be overstated. The proactive removal of these malicious extensions by Open VSX highlights the ongoing need for robust security measures and the collective responsibility of the developer community to safeguard against supply chain attacks.
