{"id":2210,"date":"2026-08-05T10:36:22","date_gmt":"2026-08-05T10:36:22","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2210"},"modified":"2026-08-05T10:36:22","modified_gmt":"2026-08-05T10:36:22","slug":"open-vsx-removes-77-malicious-evil-twin-extensions-exfiltrating-developer-data","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2210","title":{"rendered":"Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh28AJU8_kuimN9uKY5xj-0XMAMxfVP4rejHEWMJ_5FD99mAvt8dEsRuGhlCGb63VjWykzePg_-tuaTqNycmvhZy3oFRFAuVHbwpsAg6ae599Pl7bYQVb7Qo7fDuDjWMHmHZOLfWc9HZkQlyAis8LNMmkS_wnKbvliVNsOej4p6XV_KbiFHHzJp1SjGFU1G\/s1700-e365\/vscode.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed.<\/p>\n<p>The \u00abevil twin\u00bb extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of August 3, 2026.<\/p>\n<p>\u00abIn most of the packages it sends little more than the machine&#8217;s hostname,\u00bb security researchers Ax Sharma and Cody Nash <a href=\"https:\/\/www.manifold.security\/blog\/open-vsx-evil-twin-extensions\" target=\"_blank\">said<\/a>. \u00abIn nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside.\u00bb<\/p>\n<p>Of the identified extensions, 58 have been described as lightweight tools designed to exfiltrate the hostname and, in some cases, the workspace folder name or editor version.<\/p>\n<p>The rest are reconnaissance payloads that transmit the developer-related information: local hostname and operating system username, the editor&#8217;s name, version, host kind and machine ID, the platform and architecture, the locale and timezone, and the open workspace&#8217;s folder name and full file system path.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlocker-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh5OTk93vfDmhLLtqoMsx4w59kseqsUysQ92SKB-S2vDoKsMmMfCCkx8AbG5MFzFvZ7rkzKd5LtgOCxlRF2FJ-0FArsVhpOnTMX31VBi9TX-z1Pgv9oSvXiT23KyDlxtVqI0dPRdMIuWc9fbNWgQF8CisKtMme0LpNr79b4wRaeDRxCjfGB8GsxfXa8Ltro\/s728-e100\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Both share the same data-exfiltration domain, as well as similarities in code and behavior. The names of the 19 extensions are listed below &#8211;<\/p>\n<ul>\n<li>amd.gaia-vscode<\/li>\n<li>artsy.artsy-studio-extension-pack<\/li>\n<li>configcat.configcat-feature-flags<\/li>\n<li>iotaledger.iota-move<\/li>\n<li>marketplace.visualstudio<\/li>\n<li>obyte.oscript-vscode-plugin<\/li>\n<li>openeuphoria.vscode-euphoria<\/li>\n<li>oss.sfmc-devtools-vscode<\/li>\n<li>rumbledb.jsoniq-vscode<\/li>\n<li>ssagov.uef-snippets<\/li>\n<li>taskfile.vscode-task<\/li>\n<li>doi.fileheadercomment<\/li>\n<li>mengsiCode.vscode-django-boilerplate<\/li>\n<li>move.move-analyzer<\/li>\n<li>uavcan.dsdl<\/li>\n<li>vs-publisher-988541.apexsql-power-tools<\/li>\n<li>casualjim.gotemplate<\/li>\n<li>jcamp.dotnet-test-provider-view<\/li>\n<li>superposition.supertoml-analyzer<\/li>\n<\/ul>\n<p>What&#8217;s notable about the campaign is that it reuses the names, namespaces, and descriptions of real Open VSX extensions, but they are published through unrelated accounts and assigned a low version number (e.g., 0.0.1). The main change involves swapping the contents of the bundled \u00abextension.js\u00bb file with capabilities to capture and transmit data, while framing the collection as \u00abanonymous usage metrics.\u00bb<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>None of the extensions offer the advertised functionality mentioned in their listings. Instead, they display a status bar item along with a message that states they are active, before firing the data exfiltration step. In all 77 extensions, the data is sent to \u00abmangorbit[.]com,\u00bb which was registered on July 15, 2026, 11 days before the first packages were published.<\/p>\n<p>The extensions that are part of the second set cluster have also been found to carry out the following steps &#8211;<\/p>\n<ul>\n<li>Inspect files in the workspace&#8217;s .git directory to obtain Git remote hosts and organizations, the domain of the developer&#8217;s configured email, the current branch, and the HEAD commit SHA hash.<\/li>\n<li>Enumerate up to 60 installed extension IDs and pick up the proxy hostname from the environment<\/li>\n<li>The names of any CI markers present, and separately the values of GITHUB_REPOSITORY, CI_PROJECT_PATH, the Azure DevOps collection URI, the Buildkite organisation slug, the CircleCI project username, the Codespace name and the Gitpod workspace context URL from CI environments<\/li>\n<li>Read the editor&#8217;s own telemetry opt-out setting, checks if it&#8217;s enabled, and sends the status<\/li>\n<\/ul>\n<p>Further analysis indicates that the malicious code has contingency plans in place to query a DNS TXT record to retrieve a fallback exfiltration URL in the event the primary domain is blocked or taken down. The recon variant also features a retry mechanism that triggers the collection later on, suggesting the objective goes beyond a simple one-shot experiment.<\/p>\n<p>\u00abIn the recon variant, attempts come at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on every editor restart and giving up only after seven days,\u00bb the researchers explained. \u00abA machine that is offline, firewalled, or behind a proxy that drops the first request gets asked again for a week.\u00bb<\/p>\n<p>\u00abThe recon variant checks whether the open workspace&#8217;s own devcontainer.json or .vscode\/extensions.json references the extension&#8217;s ID, and reports the answer as a single flag. In plain terms, it distinguishes installs that a repository&#8217;s configuration caused from installs a human chose. That is the field you would want if the question you were asking was how am I being pulled in, and by what.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The disclosure comes as 450 unique npm packages spanning 2,244 artifacts have been compromised as part of a <a href=\"https:\/\/socket.dev\/supply-chain-attacks\/keyv-and-cacheable-compromise\" target=\"_blank\">new software supply chain attack<\/a> to deliver an information stealer and leverage the stolen npm token to push trojanized versions containing the same malware. The compromise campaign has been codenamed ChainDrop.<\/p>\n<p>\u00abThe malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload,\u00bb Microsoft <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/08\/04\/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm\/\" target=\"_blank\">said<\/a>. \u00abThe malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes.\u00bb<\/p>\n<p>\u00abThe malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.\u00bb<\/p>\n<p>Although the tradecraft resembles the tradecraft observed in past Shai-Hulud npm worm activity, the activity remains unattributed at this stage.<\/p>\n<p>\u00abThis sample also shows techniques not documented in earlier Shai-Hulud reporting: it downloads a standalone Bun runtime to execute a bundled second stage, uses a modular dispatcher with separate GitHub and domain-based delivery channels, and plants autostart hooks in .claude and .vscode to reach developers and AI coding agents who clone the source,\u00bb Socket <a href=\"https:\/\/socket.dev\/blog\/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain\" target=\"_blank\">said<\/a>.<\/p>\n<p>OX Security noted the ongoing supply chain attacks targeting npm calls for a security layer that goes beyond blocking install scripts and requiring two-factor authentication (2FA) for maintainer accounts.<\/p>\n<p>\u00abIt needs granular permission control over what a package can and can&#8217;t do,\u00bb security researcher Moshe Siman Tov Bustan <a href=\"https:\/\/www.ox.security\/blog\/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable\/\" target=\"_blank\">said<\/a>. \u00abnpm packages should require permission before they can exfiltrate AWS keys and GitHub credentials in a single command.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2211,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[38,223,2882,2884,361,33,681,2229,2883,682],"class_list":["post-2210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-data","tag-developer","tag-evil","tag-exfiltrating","tag-extensions","tag-malicious","tag-open","tag-removes","tag-twin","tag-vsx"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2210"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2210\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2211"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}