Open VSX – Malicious Extensions

Overview

The Open VSX marketplace has removed 77 malicious extensions that impersonated legitimate developer tools while secretly exfiltrating sensitive system and workspace data. Security researchers at Manifold Security discovered the campaign, which ran between July 26 and August 1, 2026, and confirmed removal by August 3, 2026.

How the Evil Twin Extensions Worked

• Impersonation: Extensions reused names, namespaces, and descriptions of real Open VSX tools but were published under unrelated accounts.
• Low version numbers: Most were listed as 0.0.1, signaling fresh uploads.
• Modified extension.js: Instead of providing functionality, the file captured and transmitted data.
• Fake “usage metrics”: Data collection was framed as anonymous telemetry.

Data Exfiltration Details

• 58 lightweight tools: Sent hostnames, workspace folder names, or editor versions.
• 19 reconnaissance payloads: Gathered detailed developer environment data, including:
  • Hostname, OS username, machine ID
  • Editor name, version, locale, timezone
  • Workspace folder paths and CI system details
  • Git remote hosts, commit hashes, and CI environment variables

All data was sent to mangorbit[.]com, registered on July 15, 2026, just days before the uploads.

Recon Variant Behavior

• Persistence: Retried exfiltration every 15 minutes, then at longer intervals, for up to 7 days.
• Fallback mechanism: Queried DNS TXT records to retrieve alternate exfiltration domains.
• CI environment targeting: Extracted GitHub, Azure DevOps, Buildkite, CircleCI, Codespaces, and Gitpod context.
• Install source tracking: Checked if installs came from repository configs or manual user choice.

Names of Malicious Recon Extensions

Examples include:

• amd.gaia-vscode
• marketplace.visualstudio
• iotaledger.iota-move
• oss.sfmc-devtools-vscode
• superposition.supertoml-analyzer

Wider Supply Chain Context

This disclosure coincides with ChainDrop, a massive npm compromise affecting 450 packages and 2,244 artifacts.

• Delivered a Mini Shai‑Hulud worm via obfuscated Bun‑based JavaScript.
• Exploited npm lifecycle hooks to auto‑execute malware.
• Used stolen GitHub credentials to inject malicious configs into repositories.
• Established persistence through .claude and .vscode autostart hooks.

Defensive Guidance

• Audit installed extensions: Verify sources and check for suspicious low‑version packages.
• Monitor telemetry settings: Ensure opt‑out flags are respected.
• Restrict CI secrets: Limit environment variables accessible to extensions.
• Adopt granular permissions: Prevent packages from exfiltrating credentials without explicit approval.
• Enable 2FA: Secure maintainer accounts against takeover.

Expert in the Cloud Insight

The Open VSX incident shows how developer ecosystems are prime targets for supply chain attacks. By mimicking trusted tools, attackers infiltrated environments where sensitive code and CI secrets reside. For defenders, the lesson is clear: trust must be verified, telemetry must be monitored, and supply chain security must extend beyond package installation to granular permission control.