Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Summary

The Open VSX marketplace has removed 77 malicious extensions that impersonated legitimate developer tools. These 'evil twin' extensions, uploaded between July 26 and August 1, 2026, exfiltrated sensitive system and development environment data, including hostnames, open repositories, and CI system details. The malicious code sent data to the domain 'mangorbit[.]com' and included reconnaissance capabilities to gather Git information and installed extension IDs.

Full text

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data Ravie LakshmananAug 05, 2026Software Supply Chain / Artificial Intelligence A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of August 3, 2026. "In most of the packages it sends little more than the machine's hostname," security researchers Ax Sharma and Cody Nash said. "In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside." Of the identified extensions, 58 have been described as lightweight tools designed to exfiltrate the hostname and, in some cases, the workspace folder name or editor version. The rest are reconnaissance payloads that transmit the developer-related information: local hostname and operating system username, the editor's name, version, host kind and machine ID, the platform and architecture, the locale and timezone, and the open workspace's folder name and full file system path. Both share the same data-exfiltration domain, as well as similarities in code and behavior. The names of the 19 extensions are listed below - amd.gaia-vscode artsy.artsy-studio-extension-pack configcat.configcat-feature-flags iotaledger.iota-move marketplace.visualstudio obyte.oscript-vscode-plugin openeuphoria.vscode-euphoria oss.sfmc-devtools-vscode rumbledb.jsoniq-vscode ssagov.uef-snippets taskfile.vscode-task doi.fileheadercomment mengsiCode.vscode-django-boilerplate move.move-analyzer uavcan.dsdl vs-publisher-988541.apexsql-power-tools casualjim.gotemplate jcamp.dotnet-test-provider-view superposition.supertoml-analyzer What's notable about the campaign is that it reuses the names, namespaces, and descriptions of real Open VSX extensions, but they are published through unrelated accounts and assigned a low version number (e.g., 0.0.1). The main change involves swapping the contents of the bundled "extension.js" file with capabilities to capture and transmit data, while framing the collection as "anonymous usage metrics." None of the extensions offer the advertised functionality mentioned in their listings. Instead, they display a status bar item along with a message that states they are active, before firing the data exfiltration step. In all 77 extensions, the data is sent to "mangorbit[.]com," which was registered on July 15, 2026, 11 days before the first packages were published. The extensions that are part of the second set cluster have also been found to carry out the following steps - Inspect files in the workspace's .git directory to obtain Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the HEAD commit SHA hash. Enumerate up to 60 installed extension IDs and pick up the proxy hostname from the environment The names of any CI markers present, and separately the values of GITHUB_REPOSITORY, CI_PROJECT_PATH, the Azure DevOps collection URI, the Buildkite organisation slug, the CircleCI project username, the Codespace name and the Gitpod workspace context URL from CI environments Read the editor's own telemetry opt-out setting, checks if it's enabled, and sends the status Further analysis indicates that the malicious code has contingency plans in place to query a DNS TXT record to retrieve a fallback exfiltration URL in the event the primary domain is blocked or taken down. The recon variant also features a retry mechanism that triggers the collection later on, suggesting the objective goes beyond a simple one-shot experiment. "In the recon variant, attempts come at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on every editor restart and giving up only after seven days," the researchers explained. "A machine that is offline, firewalled, or behind a proxy that drops the first request gets asked again for a week." "The recon variant checks whether the open workspace's own devcontainer.json or .vscode/extensions.json references the extension's ID, and reports the answer as a single flag. In plain terms, it distinguishes installs that a repository's configuration caused from installs a human chose. That is the field you would want if the question you were asking was how am I being pulled in, and by what." The disclosure comes as 450 unique npm packages spanning 2,244 artifacts have been compromised as part of a new software supply chain attack to deliver an information stealer and leverage the stolen npm token to push trojanized versions containing the same malware. The compromise campaign has been codenamed ChainDrop. "The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload," Microsoft said. "The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes." "The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path." Although the tradecraft resembles the tradecraft observed in past Shai-Hulud npm worm activity, the activity remains unattributed at this stage. "This sample also shows techniques not documented in earlier Shai-Hulud reporting: it downloads a standalone Bun runtime to execute a bundled second stage, uses a modular dispatcher with separate GitHub and domain-based delivery channels, and plants autostart hooks in .claude and .vscode to reach developers and AI coding agents who clone the source," Socket said. OX Security noted the ongoing supply chain attacks targeting npm calls for a security layer that goes beyond blocking install scripts and requiring two-factor authentication (2FA) for maintainer accounts. "It needs granular permission control over what a package can and can't do," security researcher Moshe Siman Tov Bustan said. "npm packages should require permission before they can exfiltrate AWS keys and GitHub credentials in a single command." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  artificial intelligence, CI/CD Security, Credential Theft, data exfiltration, Developer Security, Malware, Open Source, Package Security, Software Supply Chain ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT

Indicators of Compromise

• domain — mangorbit[.]com

Entities