Open VSX Malicious Extensions: 77 Fake Tools Removed

Introduction: Open VSX Malicious Extensions — Why It Matters

The Open VSX Malicious Extensions campaign has highlighted a growing threat to developers who rely on trusted extension marketplaces for productivity tools. According to security researchers, Open VSX removed 77 malicious extensions after they were found impersonating legitimate developer utilities while secretly collecting information from users’ systems.

The Open VSX Malicious Extensions were reportedly uploaded between July 26 and August 1, 2026, before being removed on August 3, 2026, following a report from Manifold Security. Instead of providing the advertised features, the extensions displayed fake activation messages and quietly gathered development environment information before sending it to attacker-controlled infrastructure.

The incident is another reminder that software supply chain attacks continue to evolve, with attackers increasingly targeting developers through trusted package repositories and extension marketplaces.

What is Open VSX?

Open VSX is an open extension registry that allows developers to discover and install extensions for Visual Studio Code-compatible editors. It provides an alternative marketplace used by several open-source development environments and enables publishers to distribute productivity tools, programming language support, debugging utilities, themes, and other extensions.

Because developers frequently install third-party extensions to improve workflows, marketplaces like Open VSX have become attractive targets for cybercriminals. A single malicious extension can gain access to valuable development information without requiring sophisticated exploitation techniques.

This latest campaign demonstrates how attackers abuse developer trust by creating convincing copies of legitimate extensions, commonly referred to as “evil twin” extensions.

What Caused the Incident?

According to the reported findings, attackers uploaded dozens of fake extensions designed to closely resemble legitimate developer tools. These extensions did not perform the functions they claimed to offer. Instead, they immediately began gathering information from the victim’s machine after installation.

Researchers identified two different categories used in the Open VSX Malicious Extensions campaign:

• 58 extensions primarily collected the machine hostname.
• 19 advanced variants gathered significantly more information from the development environment.

To avoid immediate suspicion, the extensions displayed fake activation or initialization messages, giving users the impression that the software was functioning normally while background data collection continued.

This approach allowed the malware to blend into normal development workflows, making detection more difficult.

Open VSX Malicious Extensions: Full Technical Breakdown

Timeline of Events

• July 26 – August 1, 2026: Malicious extensions uploaded to Open VSX.
• Researchers at Manifold Security identified suspicious behavior.
• August 3, 2026: Open VSX removed all 77 malicious extensions after the campaign was reported.
• Security researchers later published technical findings explaining the malware’s functionality and persistence mechanisms.

What Data Was Collected?

Security researchers found that different variants collected different levels of information.

The advanced Open VSX Malicious Extensions reportedly harvested:

• Machine hostname
• Operating system information
• Workspace directory paths
• Git repository metadata
• CI/CD environment variables
• Installed editor extensions
• Telemetry configuration
• Development environment details

All collected information was transmitted to the attacker-controlled domain mangorbit[.]com. Researchers also discovered that the malware included a DNS TXT record fallback mechanism, allowing communication to continue if the primary server became unavailable.

Another notable capability was its persistence. Rather than stopping after a failed attempt, the malware repeatedly tried to exfiltrate collected information for up to seven days, even if the editor was restarted. This retry logic increased the likelihood of successful data theft whenever network connectivity became available.

Although the campaign primarily focused on reconnaissance rather than destructive activity, the collected information could provide attackers with valuable intelligence for future targeted attacks against developers or organizations.

Potential Risks & Impact

Identity and Development Environment Risk

While the campaign did not reportedly steal passwords directly, the harvested development environment information could help attackers understand a victim’s infrastructure.

Information such as repository metadata, workspace paths, installed extensions, and CI/CD variables can reveal valuable insights into software projects, build pipelines, and organizational development practices. Such intelligence may later be used to facilitate credential theft, source code targeting, or supply chain attacks.

Business and Operational Risk

Organizations that depend on software development pipelines face significant risks when malicious extensions gain access to developer systems.

Compromised development environments can expose internal project structures, automation workflows, infrastructure details, and software configurations. Even limited reconnaissance data can improve an attacker’s ability to craft more convincing phishing campaigns or identify high-value systems within an organization.

For businesses managing sensitive intellectual property, incidents like this reinforce the importance of monitoring third-party software dependencies and enforcing strict extension approval policies.

Regulatory and Compliance Risk

Organizations operating under cybersecurity and privacy regulations may also face compliance concerns if unauthorized software collects sensitive development information.

Depending on the nature of the exposed environment, companies may need to review internal security controls, assess whether regulated data was accessible, and determine whether additional incident response procedures are required. Even when customer information is not directly affected, software supply chain incidents can trigger internal security reviews and compliance assessments.

Official Response / Statement

Open VSX removed all identified malicious extensions on August 3, 2026, after receiving reports from Manifold Security. According to the available information, the malicious packages were no longer accessible after the removal action.

Researchers stated that the fake extensions were designed to imitate legitimate developer tools while secretly collecting system information instead of providing the advertised functionality. Their findings also highlighted the malware’s persistence mechanism and its use of fallback communication methods for continued data exfiltration.

At the time of reporting, no additional public information had been disclosed regarding the total number of affected users or whether any broader compromise occurred beyond the identified malicious extensions.

Industry Context: Why Software Supply Chain Attacks Are Increasing

The Open VSX Malicious Extensions campaign reflects a broader trend of attackers targeting software supply chains rather than individual users. By compromising trusted ecosystems such as extension marketplaces and package repositories, threat actors can potentially reach thousands of developers through seemingly legitimate tools.

This incident also coincides with the discovery of the ChainDrop campaign, where researchers identified 450 compromised npm packages (2,244 artifacts) capable of spreading a credential-stealing worm across GitHub repositories, Visual Studio Code environments, and AI coding platforms. Together, these campaigns demonstrate that developer ecosystems are becoming increasingly attractive targets for cybercriminals.

To stay informed about software supply chain attacks, follow our developer cybersecurity best practices, and explore additional cybersecurity tools and resources to strengthen your organization’s security posture.

How to Protect Yourself and Your Organization

Organizations and developers can reduce exposure to similar attacks by following these security practices:

1. Verify extension publishers before installing any new extension.
2. Avoid installing recently uploaded or unusually low-version clones of popular tools.
3. Review requested permissions and extension source code whenever possible.
4. Restrict installations to trusted repositories and approved publishers.
5. Regularly audit installed extensions across developer workstations.
6. Monitor outbound network traffic for unexpected connections from development environments.
7. Remove unused extensions and keep development tools updated with the latest security patches.

Indicators of Compromise (IoCs)

Administrators should investigate systems for the following indicators:

• Malicious extensions installed between July 26 and August 1, 2026
• Unexpected outbound connections to:
  • mangorbit[.]com
• DNS TXT record queries used as fallback communication
• Fake extension activation messages
• Repeated outbound communication attempts for up to seven days
• Unexpected collection of:
  • Machine hostname
  • Workspace paths
  • Git metadata
  • CI/CD environment variables
  • Installed extensions
  • Telemetry settings

Key Takeaways

• Open VSX removed 77 malicious “evil twin” extensions after researchers reported the campaign.
• The extensions impersonated legitimate developer tools while secretly collecting system and development environment information.
• Stolen data was transmitted to attacker-controlled infrastructure with built-in persistence mechanisms.
• The incident highlights the increasing risk of software supply chain attacks targeting developers.
• Organizations should strengthen extension governance and continuously monitor developer environments.

Conclusion: Open VSX Malicious Extensions and What Happens Next

The Open VSX Malicious Extensions campaign demonstrates how attackers continue exploiting trust within developer ecosystems. Although the identified extensions have been removed, the techniques used in this campaign show that software supply chain attacks are becoming increasingly sophisticated and persistent.

Organizations should treat extension marketplaces with the same level of scrutiny as any other software source. Strengthening verification processes, monitoring development environments, and adopting secure software supply chain practices will remain essential as similar threats continue to evolve.