Full Report
A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of
Analysis Summary
# Incident Report: Open VSX "Evil Twin" Extension Campaign
## Executive Summary
A cluster of 77 malicious extensions was discovered on the Open VSX marketplace impersonating legitimate developer tools to exfiltrate system and environment data. These "evil twin" packages targeted developers by cloning real extension metadata while embedding telemetry-cloaked spyware. The campaign resulted in the compromise of development environment details, Git repository metadata, and CI/CD pipeline configurations.
## Incident Details
- **Discovery Date:** August 3, 2026 (Removal date)
- **Incident Date:** July 26, 2026 – August 1, 2026
- **Affected Organization:** Open VSX Marketplace Users
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** July 26, 2026
- **Vector:** Supply Chain Attack (Typosquatting/Impersonation)
- **Details:** Attackers uploaded 77 extensions to the Open VSX marketplace using the names, namespaces, and descriptions of legitimate tools but published through unrelated accounts.
### Lateral Movement
- **N/A:** The attack focused on environmental reconnaissance and data exfiltration from the developer's local machine or CI environment rather than moving through a corporate network.
### Data Exfiltration/Impact
- **Details:** 58 extensions exfiltrated basic hostnames. 19 "reconnaissance" variants exfiltrated deep system data, including OS usernames, full file paths, Git configurations (remotes, emails, branch names), and environment variables from CI providers (GitHub, Azure DevOps, CircleCI, etc.).
### Detection & Response
- **Discovery:** Identified by researchers at Manifold Security.
- **Response Actions:** Open VSX removed all 77 identified malicious packages on August 3, 2026.
## Attack Methodology
- **Initial Access:** Impersonation of trusted extensions on the Open VSX marketplace.
- **Persistence:** Implementation of a retry mechanism that attempts exfiltration for up to seven days and resumes on editor restart.
- **Privilege Escalation:** Not reported; operated within the permissions of the IDE.
- **Defense Evasion:** Swapped `extension.js` content; framed data theft as "anonymous usage metrics"; checked editor telemetry opt-out settings to blend in; utilized DNS TXT records for fallback C2 discovery.
- **Credential Access:** Extraction of Git remote URLs and email addresses from `.git` directories.
- **Discovery:** Enumeration of installed extensions, OS details, locale, timezone, and CI/CD environment markers.
- **Collection:** Automated scanning of workspace folders and `.git` metadata.
- **Exfiltration:** HTTPS POST requests to a hardcoded domain with a DNS-based fallback mechanism.
- **Impact:** Information disclosure and compromise of sensitive development secrets (CI/CD slugs and paths).
## Impact Assessment
- **Financial:** Undisclosed; potential costs related to rotating compromised CI/CD credentials.
- **Data Breach:** Exposure of internal repository structures, developer identities, and infrastructure paths.
- **Operational:** Disruption for developers who had to audit and remove malicious plugins.
- **Reputational:** Eroded trust in third-party marketplace ecosystems like Open VSX.
## Indicators of Compromise
- **Network Indicators:**
- mangorbit[.]com (Primary Exfiltration)
- **File Indicators:**
- `extension.js` (Modified to include malicious telemetry code)
- **Behavioral Indicators:**
- DNS TXT record queries for fallback URLs.
- Unexpected outbound traffic from IDE to non-standard domains.
- Status bar items appearing from extensions that provide no actual functionality.
## Response Actions
- **Containment:** Removal of the 77 extensions from the Open VSX marketplace.
- **Eradication:** Revocation of the publishing accounts associated with the campaign.
- **Recovery:** Public disclosure by Manifold Security to alert developers to manually audit their local installations.
## Lessons Learned
- **Marketplace Trust:** Reliance on names and descriptions is insufficient; namespace verification is critical.
- **Automated Scanning:** Marketplaces require more robust automated analysis of `extension.js` files to detect "usage metrics" that over-collect data.
- **Developer Awareness:** Developers often install tools based on "evil twin" appearance without verifying the publisher's identity or version history.
## Recommendations
- **Identity Verification:** Implement stricter publisher verification (e.g., verified badges) on the Open VSX marketplace.
- **Network Filtering:** Organizations should restrict IDE outbound traffic to known-good domains using an application-level firewall.
- **Environment Security:** Use "Secret Scanning" to ensure sensitive CI/CD variables are not stored in ways that are easily readable by IDE extensions.
- **Audit:** Developers should audit installed extensions and prefer those from official or verified namespaces.