Malicious ‘Evil Twin’ Extensions Target Open VSX Developers
Security researchers have uncovered a significant supply chain attack targeting the Open VSX marketplace, where 77 malicious extensions, dubbed ‘evil twins’, were found to be impersonating legitimate developer tools. These extensions actively exfiltrated sensitive information about the systems and development environments on which they were installed. The packages were uploaded between July 26 and August 1, 2026, and have since been removed from Open VSX as of August 3, 2026, according to Manifold Security.
This incident underscores the persistent threat of software supply chain compromises, particularly in ecosystems where developers rely on third-party components and extensions. The deceptive nature of these ‘evil twin’ extensions highlights the need for rigorous verification and proactive security measures within developer workflows.
Technical Analysis of Developer Data Exfiltration
The malicious campaign involved two primary types of data exfiltration payloads, all sharing similarities in code, behavior, and the use of the mangorbit[.]com domain for data transmission. This domain was registered just 11 days before the first malicious packages appeared.
- Lightweight Exfiltration Tools: 58 of the identified extensions were designed for less extensive data collection, primarily exfiltrating the machine’s hostname and, in some instances, the workspace folder name or editor version.
- Reconnaissance Payloads: The remaining 19 extensions carried out a more detailed reconnaissance. These collected a comprehensive description of the machine, the repository open in the editor, the CI system running, local hostname, operating system username, editor name and version, host kind and machine ID, platform and architecture, locale, timezone, and the full file system path of the open workspace.
A notable characteristic of these ‘evil twin’ extensions is their deceptive presentation. They reused names, namespaces, and descriptions of existing, legitimate Open VSX extensions but were published through unrelated accounts with conspicuously low version numbers (e.g., 0.0.1). Instead of providing advertised functionality, these extensions would display a status bar item indicating activity before initiating the data exfiltration process. The data collection was often framed misleadingly as “anonymous usage metrics.”
Further analysis revealed the reconnaissance variants included sophisticated contingency plans, such as querying a DNS TXT record for a fallback exfiltration URL if the primary domain was blocked. A retry mechanism was also observed, attempting exfiltration at intervals of roughly 15 minutes, 50 minutes, 3.5 hours, and then every 7-8 hours, resuming upon editor restarts and persisting for up to seven days. These variants also checked for references to their own ID within devcontainer.json or .vscode/extensions.json to differentiate between human-chosen installations and those pulled in by repository configurations, indicating a clear objective beyond simple, one-shot experimentation. This information can be crucial for understanding how attackers use evil twin VS Code extensions to gain initial access and persistence.
Actionable Recommendations for Open VSX Malicious Extension Detection
To effectively counter threats like these ‘evil twin’ extensions and enhance developer data exfiltration mitigation, security professionals and developers must implement several key measures:
- Verify Publisher Identity: Always scrutinize the publisher of an extension, even if the name or description seems familiar. Cross-reference with official sources or trusted communities to confirm legitimacy, especially for extensions with low version numbers.
- Monitor Network Traffic: Implement network monitoring to detect outbound connections to suspicious domains, such as
mangorbit[.]com, from developer workstations. This can help identify active exfiltration attempts. - Audit Extension Permissions: Understand and review the permissions requested by extensions during installation. Be wary of extensions asking for broad permissions not directly related to their advertised functionality.
- Educate Developers: Conduct training to raise awareness among developers about social engineering tactics, the risks of supply chain attacks, and best practices for securing their development environments.
- Implement Granular Access Controls: For organizations managing their own package registries or internal tooling, implement granular permission controls that dictate what actions an extension or package can perform, going beyond basic blocking of install scripts.
- Regular Security Audits: Periodically audit installed extensions and dependencies across all developer environments to identify and remove any suspicious or unapproved components.
Related: VS Code Marketplace Abuse: Detecting Malicious Developer Extensions, Nx Console 18.95.0 Compromise: VS Code Extension Credential Stealer