Security researchers have uncovered 77 malicious extensions on the Open VSX Marketplace that masqueraded as legitimate Visual Studio Code extensions while secretly collecting information about developers’ systems, workspaces, and CI environments.
The campaign, discovered by Manifold Security, involved “evil twin” extensions that copied the names, descriptions, and branding of legitimate developer tools but replaced their functionality with code designed to gather reconnaissance data.
All identified extensions have since been removed from Open VSX.
Fake Extensions Targeted Developers
According to Manifold Security, the malicious extensions were uploaded between July 26 and August 1, 2026, and remained available until they were removed on August 3.
Researchers found two distinct groups of malicious extensions:
- 58 lightweight variants that primarily collected the victim’s hostname, and in some cases the workspace folder name or editor version.
- 19 advanced reconnaissance variants capable of harvesting detailed information about the developer’s machine, coding environment, repositories, and CI infrastructure.
Although marketed as legitimate developer utilities, none of the extensions actually delivered the advertised features.
Instead, they simply displayed a status bar notification indicating they were active before quietly transmitting collected information to an attacker-controlled server.
What Information Was Collected?
The more advanced reconnaissance variants gathered extensive information from compromised development environments, including:
- Local hostname and operating system username
- Visual Studio Code or compatible editor version
- Editor machine ID and host type
- Operating system, platform, and CPU architecture
- Language, locale, and timezone
- Workspace folder name and full filesystem path
Researchers also found that the malware inspected Git repositories to collect:
- Git remote repository hosts
- Organization names
- Developer email domain
- Current Git branch
- Latest commit (HEAD) SHA
The extensions further enumerated installed extensions, extracted proxy configuration details, and collected information from CI/CD environments.
Among the CI-related information gathered were environment variables and identifiers associated with:
- GitHub Actions
- Azure DevOps
- GitLab CI
- CircleCI
- Buildkite
- GitHub Codespaces
- Gitpod
The malware also checked whether Visual Studio Code telemetry had been disabled and reported that setting to the attackers.
Designed for Long-Term Reconnaissance
Researchers discovered that the malware was built with persistence in mind.
If the primary command-and-control domain became unavailable, the malicious code could retrieve an alternative exfiltration server through a DNS TXT record.
Rather than giving up after a failed connection attempt, the malware repeatedly retried data collection over an extended period.
According to Manifold Security, the reconnaissance variant attempted communication approximately:
- 15 minutes after launch
- 50 minutes later
- Around 3.5 hours afterward
- Every 7–8 hours thereafter
These retries continued for up to seven days, including after the editor was restarted, allowing the malware to collect information from systems that were temporarily offline or protected by restrictive network policies.
Supply Chain Distribution Analysis
Another notable capability involved determining how the malicious extension had been installed.
The malware inspected project configuration files such as:
devcontainer.json.vscode/extensions.json
It then reported whether the extension had been automatically installed through repository configuration or manually installed by a developer.
Researchers believe this information could help attackers understand whether their malicious packages were spreading through supply chain configurations or direct user installations.
Fake Marketplace Listings
The attackers copied the names, namespaces, and descriptions of legitimate extensions already available in the Microsoft Visual Studio Marketplace.
However, several indicators distinguished the fake packages:
- Published by unrelated developer accounts
- Assigned unusually low version numbers such as 0.0.1
- Contained modified
extension.jsfiles instead of legitimate functionality - Claimed collected information represented anonymous usage metrics
All 77 extensions transmitted stolen data to the same attacker-controlled domain, mangorbit[.]com, which researchers say was registered on July 15, 2026, shortly before the campaign began.
Part of a Growing Supply Chain Threat
The discovery comes amid an increase in software supply chain attacks targeting open-source ecosystems.
Recently, security researchers revealed that more than 450 npm packages, representing over 2,200 package artifacts, were compromised as part of the ChainDrop campaign.
The malware used in that operation deployed an information-stealing worm capable of harvesting developer credentials and using stolen npm tokens to publish additional trojanized packages.
Microsoft reported that the malware executes automatically through malicious npm preinstall scripts before package installation finishes.
Researchers also found the malware could abuse stolen GitHub credentials to implant malicious Claude Code and Visual Studio Code configuration files into repositories, creating new infection paths that target both developers and AI-powered coding assistants.
Although the techniques resemble previous Shai-Hulud npm worm campaigns, researchers have not attributed the latest activity to a specific threat actor.
Recommendations for Developers
To reduce the risk of compromise, security teams and developers should:
- Install extensions only from trusted publishers.
- Verify publisher names and version history before installation.
- Review requested permissions and unexpected network activity.
- Monitor CI/CD environments for unusual outbound connections.
- Audit repositories for unauthorized VS Code configuration files.
- Regularly remove unused extensions from development environments.
- Strengthen software supply chain security with continuous package monitoring rather than relying solely on two-factor authentication or install-script restrictions.
Final Thoughts
The Open VSX campaign demonstrates how attackers are increasingly abusing trusted developer ecosystems to gather reconnaissance data and prepare for more targeted attacks.
By impersonating legitimate extensions and collecting information about development environments, repositories, and CI infrastructure, threat actors can build detailed intelligence that may later be used for credential theft, supply chain attacks, or targeted compromises.
As software supply chain attacks continue to evolve, organizations should treat IDE extensions with the same scrutiny applied to third-party code dependencies and continuously monitor developer environments for suspicious activity.
