In a significant security update, Open VSX has removed 77 extensions that were discovered to be impersonating genuine developer tools while secretly transmitting sensitive information about the systems they were installed on. Known as ‘evil twin’ extensions, these packages were identified and eliminated following an analysis by Manifold Security. The malicious extensions were initially uploaded to the Open VSX repository between July 26 and August 1, 2026, and were taken down by August 3, 2026.
Details of the Malicious Activity
According to security researchers Ax Sharma and Cody Nash, most of these extensions relayed minimal data such as the hostname of the machine. However, 19 of them sent extensive details including the machine’s description, the active repository in the editor, and the continuous integration (CI) environment the editor was operating within. A total of 58 of these extensions were identified as lightweight tools designed to extract basic information like the hostname and, occasionally, the workspace folder name or editor version.
These extensions shared a common data-exfiltration domain and exhibited similar code and behavioral patterns. The extensions masqueraded under names and descriptions of legitimate Open VSX tools, but were distributed through unrelated accounts at low version numbers, typically 0.0.1. The core alteration in these malicious extensions was the substitution of the contents of the bundled ‘extension.js’ file, enabling the capture and transmission of data under the guise of ‘anonymous usage metrics.’
Targeted Data and Transmission Methods
The remaining extensions in the group served as reconnaissance payloads, transmitting intricate developer-related information. This included the local hostname and OS username, editor name and version, and more. Notably, all data was directed to the domain ‘mangorbit[.]com,’ registered just days before the first appearance of these extensions. This exfiltration method was coupled with further intrusive actions, such as inspecting files within the ‘.git’ directory to gather details about Git remote hosts, the developer’s email domain, and CI environment variables.
These reconnaissance extensions also featured a fallback mechanism, querying a DNS TXT record to retrieve an alternative exfiltration URL should the primary domain become inaccessible. The persistence of these attacks was evident, as attempts to collect data were scheduled to retry at intervals, continuing for up to a week if initial requests went unanswered.
Broader Implications and Future Security Measures
This incident is part of a wider pattern of software supply chain attacks. Notably, 450 npm packages spanning over 2,000 artifacts were recently compromised, distributing an information-stealing malware dubbed ‘ChainDrop.’ The malicious packages exploit stolen npm tokens to propagate trojanized versions containing a credential-stealing worm. Microsoft has linked these activities to a variant of the Shai-Hulud npm worm, which employs advanced techniques not previously documented.
Security experts, including OX Security, emphasize the necessity for enhanced security measures to counter these supply chain threats. Recommendations include implementing granular permission controls and requiring explicit permissions before packages can access sensitive credentials. As the landscape of digital threats evolves, such measures are crucial for safeguarding developer environments against sophisticated attacks.
