Seventy-seven malicious extensions were discovered on the Open VSX marketplace, impersonating legitimate developer tools to exfiltrate system and development environment information. The "evil twin" campaign, identified by Manifold Security between July 26 and August 1, 2026, involved packages that mimicked existing extensions but were published through unrelated accounts, often with a low version number of 0.0.1.
All 77 extensions were linked through shared infrastructure, specifically the domain mangorbit[.]com, which was registered on July 15, 2026. Most samples communicated with pulse.mangorbit[.]com or pulse2.mangorbit[.]com, while others used api.mangorbit[.]com or randomized subdomains under cb.mangorbit[.]com. Each package included a unique tracking identifier.
The extensions did not provide the advertised functionality, instead displaying a status bar message indicating activity before transmitting data. While the listings claimed to collect "anonymous usage metrics" and stated they did not access source code or credentials, Manifold Security found that the extensions exfiltrated more data than disclosed.
Fifty-eight of the extensions primarily collected the machine's hostname, with some variants also sending the workspace folder name and editor version. The remaining 19 extensions gathered significantly more detailed information approximately four to five seconds after activation. This included the operating system username and hostname, a machine identifier, editor name and version, platform architecture, locale, timezone, and the full filesystem path of the open workspace.
These more advanced extensions also inspected files within the workspace's .git directory to obtain Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the HEAD commit hash. They enumerated up to 60 installed extensions and collected identifiers from various continuous integration (CI) and cloud development environments, such as GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, GitHub Codespaces, and Gitpod.
Manifold Security confirmed that the extensions did not access source code, credentials, authentication tokens, SSH material, or browser data. However, the collection of CI information could potentially expose private repository names or paths. Some variants were designed to continuously attempt data transmission for up to seven days and could query a DNS TXT record for a replacement URL if the hardcoded infrastructure failed.
The malicious packages impersonated extensions associated with a diverse range of technologies and organizations, including AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and a U.S. government agency namespace.
The packages were removed from Open VSX by August 3, 2026. However, developers who installed these extensions must manually remove them from their systems and applications. Manifold Security recommends checking systems and workspace configuration files for the extension IDs detailed in their report and blocking the mangorbit[.]com domain. The purpose or attribution of the campaign has not been disclosed.
