NewsPublished 4 Aug 2026

77 Open VSX extensions found harvesting developer info

Source Bleeping Computer

Description

A campaign involving 77 counterfeit extensions on the Open VSX marketplace impersonated legitimate developer tools to harvest system and development environment information. These 'evil twin' extensions transmitted metadata such as machine hostnames, workspace details, Git repository information, and continuous integration environment identifiers to a centralized server. While source code, credentials, and authentication tokens were not accessed, the collected data could enable profiling of organizations and private repositories. The malicious extensions were removed from the marketplace by August 3, 2026, but manual removal from affected systems is required.

Impact

The malicious extensions exfiltrated metadata about developers' systems and development environments, including Git repository details and CI environment identifiers, which could be used to profile organizations and potentially expose private repository names or paths. No source code, credentials, authentication tokens, SSH keys, or browser data were accessed or exfiltrated. The campaign's impact is primarily related to privacy and reconnaissance rather than direct code or credential compromise.

Defensive guidance

The malicious extensions were removed from the Open VSX marketplace as of August 3, 2026. However, affected developers must manually uninstall these extensions from their systems. It is recommended to check systems and workspace configuration files for the extension IDs identified by Manifold Security and to block the mangorbit[.]com domain at the network level to prevent ongoing data exfiltration.

References

bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2026, 19:04 UTC

References

Community reviews