Seventy-seven extensions — uploaded to Open VSX between July 26 and August 1, 2026 — were masquerading as legitimate developer tools while quietly transmitting data about the machines and development environments where they were installed.
Scope and timeline observed by Manifold Security
Manifold Security flagged the cluster of 77 “evil twin” extensions, which were removed from Open VSX as of August 3, 2026. The packages were published in a narrow window and reused the names, namespaces, and descriptions of real Open VSX extensions, but were published through unrelated accounts and assigned low version numbers such as 0.0.1.
Across all 77 packages, researchers found a common exfiltration destination: data was sent to mangorbit[.]com, a domain that was registered on July 15, 2026 — eleven days before the first malicious packages appeared in the repository.
How the evil-twin extensions operated
Rather than offering the advertised functionality, the fake extensions swapped the bundled extension.js file for code that collected and transmitted information while displaying a benign status-bar item that said the extension was active. Security researchers Ax Sharma and Cody Nash described the behavior: “In most of the packages it sends little more than the machine's hostname,” and “in nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside.”
Researchers classified the malicious packages into two groups:
- 58 lightweight exfiltration tools that send the hostname and sometimes workspace folder name or editor version.
- 19 reconnaissance payloads that collect a richer set of developer-related data, including local hostname and operating system username, the editor’s name and version, host kind and machine ID, platform and architecture, locale and timezone, and the open workspace’s folder name and full file system path.
The 19 reconnaissance extension IDs identified by the researchers are:
- amd.gaia-vscode
- artsy.artsy-studio-extension-pack
- configcat.configcat-feature-flags
- iotaledger.iota-move
- marketplace.visualstudio
- obyte.oscript-vscode-plugin
- openeuphoria.vscode-euphoria
- oss.sfmc-devtools-vscode
- rumbledb.jsoniq-vscode
- ssagov.uef-snippets
- taskfile.vscode-task
- doi.fileheadercomment
- mengsiCode.vscode-django-boilerplate
- move.move-analyzer
- uavcan.dsdl
- vs-publisher-988541.apexsql-power-tools
- casualjim.gotemplate
- jcamp.dotnet-test-provider-view
- superposition.supertoml-analyzer
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we build →Recon variant: depth, persistence, and fallback
The reconnaissance payloads performed a deeper inspection of developer environments. They looked into the workspace’s .git directory to harvest Git remote hosts and organizations, the domain of the developer’s configured email, the current branch, and the HEAD commit SHA. They enumerated up to 60 installed extension IDs, extracted a proxy hostname from the environment, and read CI markers and specific CI environment variables such as GITHUB_REPOSITORY, CI_PROJECT_PATH, the Azure DevOps collection URI, Buildkite organisation slug, CircleCI project username, Codespace name, and the Gitpod workspace context URL.
The recon code also checked the editor’s telemetry opt-out setting and reported whether it was enabled. It specifically tested whether the open workspace’s devcontainer.json or .vscode/extensions.json referenced the extension’s ID and reported that as a single flag — in the researchers’ words, “it distinguishes installs that a repository's configuration caused from installs a human chose.”
Persistence and robustness were built into the payload: the recon variant attempts exfiltration on a retry schedule “at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on every editor restart and giving up only after seven days,” the researchers said. Machines that are offline, firewalled, or behind a proxy that drops the first request are re-asked for a week. The malicious code also checks a DNS TXT record to retrieve a fallback exfiltration URL should the primary domain be blocked or taken down.
ChainDrop, Mini Shai-Hulud, and broader supply-chain activity
The Open VSX cluster arrives in the same period that researchers reported a larger npm supply-chain incident codenamed ChainDrop: “450 unique npm packages spanning 2,244 artifacts have been compromised” to deliver an information stealer and leverage stolen npm tokens to push trojanized releases. Microsoft said the compromised releases contain “a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload,” which can execute via an npm preinstall lifecycle hook.
Microsoft added that the malware “can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.” Socket’s analysis noted new techniques in the sample, including downloading a standalone Bun runtime for a second stage, a modular dispatcher with GitHub and domain-based delivery channels, and planting autostart hooks in .claude and .vscode to reach developers and AI coding agents.
OX Security argued these attacks show a need for defenses “beyond blocking install scripts and requiring two-factor authentication (2FA) for maintainer accounts,” with security researcher Moshe Siman Tov Bustan saying “It needs granular permission control over what a package can and can't do.”
What this means for developers, registries, and security teams
- Developers: a single-looking extension can exfiltrate host and repository data and can be indistinguishable in name and description from the real tool; installs pulled in by repository configuration are being distinguished from human installs, which affects trust models for CI and devcontainer-driven installs.
- Registry operators: the campaign shows malicious actors publishing through unrelated accounts with low initial version numbers and swapping implementation files (extension.js); registries should watch for reuse of legitimate names/namespaces and rapid clusters of uploads tied to newly registered domains like mangorbit[.]com.
- Security teams and platform maintainers: recon payloads include retries, fallback DNS TXT lookups, and extended persistence windows, so blocking a single domain may not be sufficient — the behavior suggests multi-stage monitoring and rapid takedown coordination will be necessary.
The Open VSX removals end one chapter of the episode; the work left is tracking where the stolen metadata traveled, whether the same identifiers appear in other ecosystems, and whether the ChainDrop compromises and the Open VSX cluster point to a shared operational aim: building rich developer profiles that can be weaponized across repositories, CI systems, and developer-to-developer supply chains.
