Developers Targeted in Sophisticated “Evil Twin” Campaign on Open VSX Marketplace
A sophisticated campaign has been uncovered on the Open VSX marketplace, where 77 extensions were found to be impersonating legitimate developer tools while secretly transmitting sensitive information about the systems and development environments where they were installed. The “evil twin” campaign was detected by researchers at Manifold Security between July 26 and August 1, 2026, who linked all 77 extensions to the same activity through a shared data-exfiltration domain.
The extensions in question reused the names, namespaces, and descriptions of real Open VSX extensions but were published through unrelated accounts. Most were assigned the low version number 0.0.1, while the legitimate extension’s bundled extension.js file was replaced with code designed primarily to collect and transmit data. The packages communicated with a server at mangorbit[.]com, which was registered on July 15, 2026, just eleven days before the first packages appeared.
Of the 77 extensions, 58 sent only a small amount of system information, such as the machine’s hostname. However, the remaining 19 contained more extensive reconnaissance, exfiltrating developer, Git repository, and continuous integration (CI) metadata. This included operating system username and hostname, machine identifier, editor name and version, platform architecture, locale, timezone, and the name and full filesystem path of the workspace open in the editor.
What’s particularly concerning is that some variants of these extensions collected more data than disclosed in their Open VSX listings, including CI information that could expose private repository names or paths. Some also checked whether they had been installed manually or automatically through a project configuration. The packages were designed to keep trying to transmit the collected data for up to seven days and supported multiple collection endpoints.
The campaign’s purpose remains unclear, but it’s evident that the operator was after more than just anonymous usage metrics. By collecting metadata from development environments, organizations, and private repositories, they could potentially profile organizations and gain valuable insights into their internal workings. While Manifold recommends checking systems and applications for these extensions, it’s essential to remember that the packages would still need to be manually removed.
For developers using Open VSX extensions, this incident highlights the importance of verifying the authenticity of any new extension before installing it. Be wary of packages with low version numbers or unclear descriptions, and always check the publisher’s account history to ensure they are legitimate. It’s also crucial to monitor your system for suspicious activity and regularly review your installed extensions’ permissions and behavior.
Source: Bleeping Computer — 2026-08-04