Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
Manifold Security found 77 extensions uploaded to the Open VSX marketplace between July 26 and August 1, 2026 that impersonate real Microsoft VS Code Marketplace tools, with all 77 sending data to mangorbit.com. 58 lightweight variants exfiltrate the hostname, while 19 recon variants collect editor details, OS username, Git remote hosts, CI environment variables (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), and installed extension IDs. The recon variant retries for up to seven days and can fall back to a DNS TXT record for exfiltration if the primary domain is blocked. The extensions were removed from Open VSX by August 3, 2026; the disclosure follows a separate npm supply chain campaign, ChainDrop, which compromised 450 packages with a Shai-Hulud worm variant.
- 58 extensions send only the hostname; 19 send detailed developer environment and CI reconnaissance.
- Evil twins reuse real Marketplace extension names and namespaces but with low version numbers like 0.0.1.
- Recon variant checks .git metadata, extension IDs, and telemetry settings, with retries spread across seven days.
- Data is framed as anonymous usage metrics and sent to the July 15, 2026-registered domain mangorbit.com.
- Related ChainDrop npm campaign hit 450 packages with a self-propagating Mini Shai-Hulud credential-stealing worm.
- ATT&CK
- T1195.001 Compromise Software Dependencies and ApplicationsT1005 Data from Local SystemT1041 Exfiltration Over C2 Channel
- Malware
- Shai-HuludMini Shai-Hulud
- Organizations
- Open VSX
- AI models
- Claude
From the original article
5 min read at thehackernews.com
A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of August 3, 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.