A batch of 77 fraudulent extensions on the Open VSX marketplace masqueraded as legitimate developer tools while secretly harvesting information about the systems and development environments where they were installed. The "evil twin" packages were uploaded between July 26 and August 1, 2026, according to Manifold Security. Open VSX removed all of the extensions as of August 3, 2026.
Of the 77 identified extensions, 58 were lightweight variants built to steal the hostname and occasionally the workspace folder name or editor version. The remaining 19 contained reconnaissance payloads that transmitted far more detailed developer information: local hostname and operating system username, the editor's name, version, host kind and machine ID, the platform and architecture, the locale and timezone, and the open workspace's folder name and complete file system path. Both groups shared the same data-exfiltration domain and exhibited similarities in code and behavior. The campaign recycled the names, namespaces, and descriptions of genuine Microsoft VS Code Marketplace extensions, but attackers published them through unrelated accounts and assigned low version numbers such as 0.0.1. None of the extensions delivered the advertised functionality listed in their descriptions. Instead, they displayed a status bar item with a message claiming they were active before executing the data exfiltration step. All 77 extensions transmitted data to "mangorbit[.]com," which was registered on July 15, 2026, eleven days before the first packages appeared.
"In most of the packages it sends little more than the machine's hostname," security researchers Ax Sharma and Cody Nash said. "In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside." The 19 reconnaissance variants also inspected files in the workspace's .git directory to capture Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the HEAD commit SHA hash. They enumerated up to 60 installed extension IDs, extracted proxy hostnames from the environment, and pulled CI markers along with values from GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URIs, Buildkite organization slugs, CircleCI project usernames, Codespace names, and Gitpod workspace context URLs. The researchers explained that in the reconnaissance variant, attempts occur at roughly fifteen minutes, fifty minutes, and three and a half hours, then every seven or eight hours, resuming on every editor restart and stopping only after seven days.
The malicious code included contingency plans to query a DNS TXT record to retrieve a fallback exfiltration URL if the primary domain was blocked or taken down. The reconnaissance variant also featured a retry mechanism that triggered collection later on, indicating the objective exceeded a simple one-shot experiment. The reconnaissance variant checked whether the open workspace's own devcontainer.json or .vscode/extensions.json referenced the extension's ID, and reported the answer as a single flag—distinguishing installs caused by a repository's configuration from installs chosen by a human. The disclosure arrives alongside news of 450 unique npm packages spanning 2,244 artifacts compromised as part of a software supply chain attack codenamed ChainDrop to deliver an information stealer and leverage stolen npm tokens to push trojanized versions. OX Security noted the ongoing supply chain attacks targeting npm require a security layer beyond blocking install scripts and requiring two-factor authentication for maintainer accounts—npm packages should require permission before they can exfiltrate credentials in a single command. Organizations relying on third-party extension marketplaces face a persistent tension between developer productivity and the risk of supply chain infiltration, particularly when malicious actors deploy patient, multi-stage collection mechanisms designed to evade detection and retry after network failures.