Open VSX Removes 77 Malicious 'Evil Twin' Extensions Exfiltrating Developer Data
Open VSX has removed 77 malicious extensions that impersonated legitimate developer tools to harvest hostnames, editor configurations, and CI environment data, sending it to a single domain registered days before publication.
Intelligence analysis by Llama
Researchers at Manifold Security found 77 "evil twin" Open VSX extensions, published July 26 to August 1, 2026, that reused real names but swapped extension.js with stealthy data-exfiltration code. The campaign exfiltrates developer environment details to mangorbit[.]com, with retry logic suggesting sustained reconnaissance rather than a one-off probe.
Imagine a toy store where bad guys copy the names and boxes of popular toys, then hide a little spy camera inside before putting them on the shelf. When a kid takes one home, the camera quietly sends pictures back. That's what happened here: someone made 77 fake coding-tool add-ons with the same names as real ones, and they sent the computer's name and the projects the programmer was working on to a secret website.
Analysis
Namespace Hijacking at Industrial Scale
The campaign's defining trick is not novel code but industrial-scale name laundering. According to researchers Ax Sharma and Cody Nash of Manifold Security, the 77 packages reuse the names, namespaces, and descriptions of real Open VSX extensions, but are published through unrelated accounts and pinned at version 0.0.1. Anyone searching for, say, taskfile.vscode-task could plausibly land on either the real one or the impostor, with virtually no visible cue separating them. The deception relies on developers trusting the marketplace's name-similarity to genuine packages and on the near-universal habit of installing whatever shows up at the top of a search result.
The actual payload sits in a swapped-out extension.js file that frames its data collection as "anonymous usage metrics." None of the extensions deliver the advertised functionality. Instead they display a status-bar message, then quietly phone home. This is a textbook example of why supply-chain security cannot rest on visual inspection of listings or even on namespace ownership — identity verification and signing must happen upstream of search results.
Two Payloads, One Domain, Persistence Mindset
The 77 packages split into two flavors, both routed to mangorbit[.]com, a domain registered July 15, 2026 — eleven days before the first malicious upload. Fifty-eight are lightweight, sending little more than the host's hostname and, in some cases, the workspace folder name or editor version. The remaining nineteen are reconnaissance payloads that pull a far richer envelope: hostname, OS username, editor name and version, host kind, machine ID, platform and architecture, locale, timezone, workspace folder and full filesystem path.
The recon variant is what elevates this from nuisance malware to a credible threat. The researchers document it inspecting .git directories to harvest Git remote hosts and organizations, the developer's configured email domain, the current branch, and the HEAD commit SHA. It enumerates up to sixty installed extension IDs, pulls proxy hostnames from environment variables, and reads an extensive list of CI markers including GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URIs, Buildkite slugs, CircleCI usernames, Codespace names, and Gitpod URLs. It even reads the editor's own telemetry opt-out setting and reports whether telemetry is enabled.
A built-in DNS TXT fallback ensures the exfiltration channel survives domain takedowns, and a retry schedule — fifteen minutes, fifty minutes, three and a half hours, then every seven to eight hours, persisting across editor restarts for up to a week — suggests the operator treats each install as a long-lived reconnaissance asset rather than a one-shot probe. The package also checks whether the active workspace's devcontainer.json or .vscode/extensions.json references the malware's own ID, a flag that distinguishes automatic pulls from human installs and tells the operator exactly which repositories are recursively pulling the payload in.
A Broader Wave of Editor and npm Compromise
The disclosure lands alongside a parallel npm compromise Microsoft has dubbed ChainDrop: 450 unique packages spanning 2,244 artifacts, distributing a Mini Shai-Hulud variant — a Bun-based, heavily obfuscated credential-stealing worm that runs through an npm preinstall hook and uses stolen GitHub tokens to publish trojanized follow-on versions. Microsoft notes the malware also writes Claude and Visual Studio Code configuration files into repositories, opening a developer-to-developer infection path that has not been documented in prior Shai-Hulud reporting.
Taken together, the two campaigns illustrate how attackers are converging on the developer desktop as a unified target. The Open VSX campaign pilfers topology; the npm worm pilfers tokens that can rewrite that topology. Until marketplaces enforce publisher identity, signed bundles, and post-install behavioral review, the weakest link in the developer supply chain will remain the moment a developer types "install extension."
Key points
- Open VSX removed 77 malicious extensions uploaded between July 26 and August 1, 2026, after researchers Ax Sharma and Cody Nash of Manifold Security flagged them.
- The packages reused names, namespaces, and descriptions of real extensions but were published from unrelated accounts at version 0.0.1, with extension.js swapped for stealthy exfiltration code.
- All 77 exfiltrated data to mangorbit[.]com, a domain registered July 15, 2026 — eleven days before the first upload.
- The 19 'recon' variants harvest Git remotes, HEAD SHAs, up to 60 installed extension IDs, CI environment variables across GitHub, Azure DevOps, Buildkite, CircleCI, Codespaces and Gitpod, and the editor's telemetry opt-out setting.
- The malicious code uses a DNS TXT-record fallback for its exfiltration URL and retries every seven to eight hours for up to a week, indicating a persistent reconnaissance operation rather than a one-shot probe.
- The disclosure coincides with Microsoft's reporting of a separate npm supply-chain compromise called ChainDrop — 450 packages distributing a Mini Shai-Hulud credential-stealing worm that also injects Claude and VS Code config into repositories.
Open VSX's prompt removal of all 77 packages within two days of the last upload shows that marketplace operators can still act decisively when researchers publish well-formed findings. If Manifold Security's disclosure leads to permanent publisher-identity verification and signed extensions across Open VSX and the broader VS Code ecosystem, future twin packages would be far harder to plant.
The DNS TXT fallback, week-long retry schedule, and enrichment of CI and Git metadata suggest the operator is willing to invest in long-dwell infrastructure, meaning takedowns of `mangorbit[.]com` are unlikely to end the campaign. With Open VSX publishing remaining far less curated than Microsoft's own marketplace, similar namespace-hijacking waves will almost certainly recur, and the same developers hit here are also in the blast radius of the parallel npm ChainDrop worm.
