77 "Evil Twin" Open VSX Extensions

What it is

A cluster of 77 malicious Open VSX extensions ("evil twins") uploaded July 26–August 1, 2026 and removed August 3, 2026, tracked by Manifold Security (Ax Sharma, Cody Nash). They clone the names, namespaces, and descriptions of real Microsoft VS Code Marketplace extensions but are published by unrelated accounts at low version numbers (e.g. 0.0.1), with extension.js swapped for data-collection code framed as "anonymous usage metrics." None deliver the advertised functionality — they display a "active" status-bar item, then exfiltrate.

How it works

58 lightweight variants send only hostname (sometimes workspace folder name / editor version). The 19 recon variants additionally read the workspace .git directory (remote hosts/orgs, configured email domain, branch, HEAD SHA), enumerate up to 60 installed extension IDs and the proxy hostname, and extract CI markers — GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite org slug, CircleCI project username, Codespace name, Gitpod context URL. They also read the editor's telemetry opt-out setting. Notably, the recon variant checks whether the workspace's own devcontainer.json or .vscode/extensions.json references the extension ID — distinguishing config-driven installs from human choices ("how am I being pulled in, and by what").

Preconditions / Affected

Anyone who installed one of these from Open VSX (i.e. VS Code forks / editors using Open VSX rather than the Microsoft Marketplace). The 19 recon extension IDs:

amd.gaia-vscode, artsy.artsy-studio-extension-pack, configcat.configcat-feature-flags,
iotaledger.iota-move, marketplace.visualstudio, obyte.oscript-vscode-plugin,
openeuphoria.vscode-euphoria, oss.sfmc-devtools-vscode, rumbledb.jsoniq-vscode,
ssagov.uef-snippets, taskfile.vscode-task, doi.fileheadercomment,
mengsiCode.vscode-django-boilerplate, move.move-analyzer, uavcan.dsdl,
vs-publisher-988541.apexsql-power-tools, casualjim.gotemplate,
jcamp.dotnet-test-provider-view, superposition.supertoml-analyzer

What to do

• Check installed extensions for these IDs at version 0.0.1 (or other low versions) and uninstall.
• Block/alert on the exfil domain mangorbit[.]com (registered July 15, 2026, 11 days before first upload).
• Do not rely on a single network block: the recon variant queries a DNS TXT record for a fallback exfiltration URL if the primary domain is unreachable, and retries at ~15 min, ~50 min, ~3.5 hr, then every 7–8 hr, resuming on each editor restart and giving up only after 7 days. A machine that was offline or firewalled at first contact will retry for a week.
• Because CI env vars and Git remotes may have been read, treat exposed repository/CI identifiers and any credentials reachable from the workspace as potentially disclosed.

Caveats

The article's later sections cover a separate, unattributed npm campaign (ChainDrop / Mini Shai-Hulud, per Microsoft and Socket) — related supply-chain context but not part of this Open VSX cluster.