Reported by 3 outlets

Timeline

1. original reporting

   77 "Evil Twin" Open VSX Extensions Harvest Developer Metadata — Shared C2 at mangorbit[.]com

   bleepingcomputer.com · 70d ago · August 5th, 2026

   Manifold Security detected 77 counterfeit extensions on the Open VSX marketplace (July 26–August 1) that impersonated legitimate tools — including namespaces for AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and a US government agency — while exfiltrating developer and environment data to mangorbit[.]com (registered July 15). All 77 shared the C2 domain and code/network behavior; all were published from unrelated accounts at version 0.0.1 with the legitimate extension.js replaced by a data-collection stub masquerading as an "active" status indicator. 58 sent minimal system info (hostname); 19 ran deeper reconnaissance ~4–5 seconds after activation: OS username/hostname, machine ID, workspace paths, .git metadata (remote hosts/orgs, developer email domain, branch, HEAD commit), up to 60 installed extensions, and CI/cloud environment identifiers (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod) — enough to profile organizations and private repos. No source code, credentials, tokens, SSH material, or browser data was accessed. Packages were removed from Open VSX by August 3, but must be manually removed from developer machines; block mangorbit[.]com.

   Action: Audit extension inventories against Manifold's published ID list; treat extension marketplaces as a supply-chain trust boundary — pin extensions, review publisher history, and block the C2 domain.

2. update from gbhackers.com

   Open VSX Unblocks 3 IDs Used in 77-Extension Evil-Twin Malware Campaign

   gbhackers.com · 50d ago · August 24th, 2026

   Open VSX has removed three extension identifiers from its malicious-extension list after the legitimate projects they impersonated began reclaiming their names. The move restores publishing access for the affected maintainers but highlights a supply-chain tracking gap: a single extension ID can represent both a removed malicious artifact and a later legitimate release. Between August 16 […] The post Open VSX Unblocks 3 IDs Used in 77-Extension Evil-Twin Malware Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   Open VSX Unblocks 3 Extension IDs Used in Malware Campaign, Complicating Threat Tracking

   cyberpress.org · 50d ago · August 24th, 2026

   Open VSX removed three extension IDs from its malicious-extension list between August 16 and August 20, restoring publishing access to legitimate developers whose identifiers had been hijacked in a large-scale impersonation campaign. The reversals affect AlDuncanson.react-hooks-snippets , magne-sjaastad.opm-flow-editor-support , and rumbledb.jsoniq-vscode all three previously used by impostors in a 77-extension evil-twin campaign documented by Manifold Security earlier this month, reflecting ongoing challenges in mitigating supply chain attacks across open-source ecosystems. Open VSX Unblocks 3 Malicious Extension IDs Each case followed a similar pattern: attackers registered extension names already established in Microsoft’s VS Code Marketplace but not yet claimed on Open VSX, then published malicious lookalikes. When the real maintainers later tried to publish, they were blocked with messages flagging their own IDs as “known malicious.” Extension Unblock Request Discussion (Image Source: socket.dev) React Hooks Snippets maintainer Al Duncan requested an unblock on August 16 after hitting this wall; an Open VSX maintainer confirmed the tie to the campaign and removed the ID that day, though no legitimate release had appeared on Open VSX as of August 24, according to Socket’s threat analysis .