77 malicious extensions found on Open VSX marketplace

Seventy-seven malicious extensions impersonating legitimate developer tools were discovered on the Open VSX marketplace, transmitting system and development environment information. The campaign, dubbed "evil twin," was identified by Manifold Security between July 26 and Aug. 1, 2026, with all malicious extensions linked through shared infrastructure and code. The extensions did not access source code or credentials, but their purpose remains speculative, with further coverage provided by Bleeping Computer.

The "evil twin" campaign involved 77 extensions on the Open VSX marketplace that mimicked legitimate tools but were published under unrelated accounts. While 58 extensions exfiltrated basic system information like hostname, the remaining 19 conducted more extensive reconnaissance. These 19 extensions collected operating system details, machine identifiers, editor information, Git repository metadata, and identifiers from CI/cloud development environments such as GitHub and Azure DevOps. All 77 extensions communicated with a shared domain, mangorbit[.]com. Although the extensions claimed to collect only anonymous usage metrics and stated they did not access source code or credentials, they transmitted more data than disclosed. The packages were removed from the marketplace by Aug. 3, 2026, but developers must manually remove them from their systems. Manifold Security recommends blocking the mangorbit[.]com domain and checking for suspicious extension IDs.

Source: Bleeping Computer