Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Summary

A cluster of 77 malicious extensions was removed from the Open VSX registry after researchers at Manifold Security identified them impersonating legitimate developer tools. Uploaded between 26 July and 1 August 2026, the packages were taken down on 3 August. Fifty-eight of them performed lightweight exfiltration of the host machine’s hostname and, in some cases, the workspace folder name or editor version. The remaining nineteen collected a broader set of identifiers, including operating-system username, editor version and machine ID, platform architecture, locale, timezone, and the full path of the open workspace.

All 77 extensions reused the names, namespaces and descriptions of existing Open VSX packages but were published from unrelated accounts at low version numbers such as 0.0.1. They replaced the bundled extension.js with code that transmitted collected data to the domain mangorbit.com, registered eleven days before the first malicious uploads. The extensions displayed a status-bar notification claiming to be active, then performed the exfiltration under the guise of anonymous usage metrics. The reconnaissance variants included retry logic that re-attempted collection at intervals up to seven days and queried DNS TXT records for fallback exfiltration endpoints if the primary domain became unavailable. They also checked whether the workspace’s devcontainer.json or .vscode/extensions.json referenced the extension, allowing the operators to distinguish configuration-driven installs from manual ones.

The same disclosure described a separate supply-chain campaign, named ChainDrop, that compromised 450 unique npm packages and 2,244 artifacts. Attackers used stolen maintainer tokens to publish trojanized versions containing a Mini Shai-Hulud variant: a self-propagating credential-stealing worm delivered through an obfuscated Bun-based payload executed via the npm preinstall hook. The malware further leveraged harvested GitHub credentials to inject malicious configuration files into .claude and .vscode directories, creating persistence across cloned repositories and an additional vector that reaches both human developers and AI coding agents. The activity shares techniques with earlier Shai-Hulud operations but remains unattributed.

Why it matters

This article highlights emerging supply chain threats targeting developer environments and AI coding agents like Claude. Security professionals in the Dutch AI market must address these vectors to secure their CI/CD pipelines and prevent data exfiltration.