Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious "evil twin" extensions on Open VSX impersonated legitimate developer tools to exfiltrate system and environment data, all routing to mangorbit[.]com Two tiers of malware: 58 lightweight variants stole hostnames and workspace info, while 19 reconnaissance variants collected detailed machine profiles, Git metadata, CI environment variables, and installed extension lists Attackers reused real extension names, namespaces, and descriptions but published through unrelated accounts at vers
Analysis
TL;DR
- 77 malicious "evil twin" extensions on Open VSX impersonated legitimate developer tools to exfiltrate system and environment data, all routing to mangorbit[.]com
- Two tiers of malware: 58 lightweight variants stole hostnames and workspace info, while 19 reconnaissance variants collected detailed machine profiles, Git metadata, CI environment variables, and installed extension lists
- Attackers reused real extension names, namespaces, and descriptions but published through unrelated accounts at version 0.0.1, swapping the bundled extension.js with data-exfiltration code disguised as "anonymous usage metrics"
- The recon variant featured sophisticated persistence: DNS TXT-based fallback URLs, retry mechanisms at 15-minute/50-minute/3.5-hour intervals then every 7-8 hours for up to 7 days, and detection of whether installs were config-driven or manual
- This campaign coincides with the ChainDrop supply chain attack compromising 450 npm packages and 2,244 artifacts, delivering a Mini Shai-Hulud self-propagating worm that steals credentials and injects malicious VS Code/Claude configs into repositories
Why It Matters
This incident highlights the growing threat of marketplace impersonation attacks against developer tooling ecosystems, where attackers exploit the trust developers place in extension names and namespaces. It also underscores the interconnected nature of modern supply chain attacks, where compromise of package registries like npm and extension marketplaces like Open VSX can create cascading infection paths through both human developers and AI coding agents.
Technical Details
- Attack vector: 77 extensions published between July 26 and August 1, 2026, on Open VSX, all sharing the same exfiltration domain (mangorbit[.]com, registered July 15, 2026) and similar code structure
- Data exfiltration scope: Lightweight variants sent hostnames, workspace folder names, and editor versions; recon variants collected OS usernames, machine IDs, platform/architecture, locale/timezone, full filesystem paths, Git remote hosts/organizations/branches/commit SHAs, up to 60 installed extension IDs, proxy hostnames, and CI environment variables (GitHub, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod)
- Persistence and evasion: DNS TXT record queries for fallback exfiltration URLs, aggressive retry scheduling (15 min → 50 min → 3.5 hrs → every 7-8 hrs for 7 days), resumption on editor restart, and detection of devcontainer.json/.vscode/extensions.json to flag config-driven vs. manual installs
- ChainDrop npm attack: 450 unique npm packages with 2,244 artifacts compromised, delivering a Mini Shai-Hulud variant—a self-propagating credential-stealing worm using a Bun-based JavaScript payload executed via npm preinstall lifecycle hooks, with new techniques including standalone Bun runtime downloads, modular GitHub/domain delivery channels, and autostart hooks in .claude and .vscode directories
- AI agent targeting: The ChainDrop malware specifically plants hooks to reach AI coding agents (Claude, VS Code) that clone infected repositories, creating a developer-to-developer and developer-to-agent infection path
Industry Insight
- Extension marketplace governance requires stricter verification of namespace ownership and publisher identity; the fact that attackers could publish under real extension names through unrelated accounts reveals a critical authentication gap that platforms must address
- The integration of AI coding agents into development workflows introduces new attack surfaces—malware that targets .claude and .vscode configs can now infect not just human developers but the AI tools they use, potentially amplifying the blast radius of supply chain compromises
- Organizations should enforce strict extension installation policies, audit devcontainer and workspace configuration files for unauthorized references, and monitor for anomalous outbound network traffic from development environments, particularly to newly registered domains
Disclaimer: The above content is generated by AI and is for reference only.