Open VSX Removes 77 “Evil Twin” Extensions That Stole Developer Data

Researchers at Manifold Security discovered a cluster of 77 extensions in the Open VSX catalog that posed as legitimate developer tools but in fact gathered information about the systems they were installed on. The packages were uploaded to the repository between July 26 and August 1, 2026, and were removed on August 3.

“Evil Twins”

The scheme turned out to be simple, and dangerous precisely because of it: the attackers took the names, namespaces and descriptions of real extensions, published copies through unrelated accounts, and assigned a low version number — 0.0.1, for example. Inside, the contents of the extension.js file were swapped out, with code injected to collect and send data under the guise of “anonymous usage statistics.” None of the extensions performed its advertised function: they merely showed a message in the status bar saying they were “active” and kicked off the exfiltration.

Most — 58 of them — were simple collectors that transmitted the hostname, and sometimes the name of the working folder or the editor version. The remaining 19 turned out to be full-fledged reconnaissance payloads. They sent the OS username, the editor's name and version, the machine ID, the platform, architecture, locale, time zone, and the full path to the open project.

What the scouts were after

The advanced version peeked into the .git directory to pull remote Git hosts and organizations, the domain from the developer's configured email, the current branch and the hash of the last commit. It enumerated up to 60 installed extensions, read CI environment variables (GITHUB_REPOSITORY, the Azure DevOps collection URI, the Buildkite organization slug, the Codespace name, the Gitpod workspace context), and even checked whether telemetry was enabled in the editor — and reported on it.

All 77 extensions sent data to the domain mangorbit[.]com, registered on July 15 — 11 days before the first packages appeared. In case of a block, a fallback is built in: the code requests a TXT-type DNS record to obtain a backup exfiltration address.

The reconnaissance variant is persistent: attempts repeat at roughly 15 and 50 minutes, three and a half hours, then every seven to eight hours, resuming with each restart of the editor, and stopping only after a week. A machine that was offline or behind a proxy will still be polled again. What's more, the extension checks whether its identifier is mentioned in the project's devcontainer.json or .vscode/extensions.json — that is, it distinguishes an installation imposed by a repository's configuration from a person's deliberate choice. As the researchers note, this is exactly the kind of question you ask when you want to understand “how and through what I'm being drawn in.”

The incident coincided with another supply-chain attack: 450 npm packages were compromised to distribute a self-propagating credential-stealing worm codenamed ChainDrop.

Source: The Hacker News