A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed.
The “evil twin” extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of August 3, 2026.
“In most of the packages it sends little more than the machine’s hostname,” security researchers Ax Sharma and Cody Nash said. “In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside.”
Of the identified extensions, 58 have been described as lightweight tools designed to exfiltrate the hostname and, in some cases, the workspace folder name or editor version.
The rest are reconnaissance payloads that transmit the developer-related information: local hostname and operating system username, the editor’s name, version, host kind and machine ID, the platform and architecture, the locale and timezone, and the open workspace’s folder name and full file system path.
Both share the same data-exfiltration domain, as well as similarities in code and behavior. The names of the 19 extensions are listed below –
- amd.gaia-vscode
- artsy.artsy-studio-extension-pack
- configcat.configcat-feature-flags
- iotaledger.iota-move
- marketplace.visualstudio
- obyte.oscript-vscode-plugin
- openeuphoria.vscode-euphoria
- oss.sfmc-devtools-vscode
- rumbledb.jsoniq-vscode
- ssagov.uef-snippets
- taskfile.vscode-task
- doi.fileheadercomment
- mengsiCode.vscode-django-boilerplate
- move.move-analyzer
- uavcan.dsdl
- vs-publisher-988541.apexsql-power-tools
- casualjim.gotemplate
- jcamp.dotnet-test-provider-view
- superposition.supertoml-analyzer
What’s notable about the campaign is that it reuses the names, namespaces, and descriptions of real Open VSX extensions, but they are published through unrelated accounts and assigned a low version number (e.g., 0.0.1). The main change involves swapping the contents of the bundled “extension.js” file with capabilities to capture and transmit data, while framing the collection as “anonymous usage metrics.”
None of the extensions offer the advertised functionality mentioned in their listings. Instead, they display a status bar item along with a message that states they are active, before firing the data exfiltration step. In all 77 extensions, the data is sent to “mangorbit[.]com,” which was registered on July 15, 2026, 11 days before the first packages were published.
The extensions that are part of the second set cluster have also been found to carry out the following steps –
- Inspect files in the workspace’s .git directory to obtain Git remote hosts and organizations, the domain of the developer’s configured email, the current branch, and the HEAD commit SHA hash.
- Enumerate up to 60 installed extension IDs and pick up the proxy hostname from the environment
- The names of any CI markers present, and separately the values of GITHUB_REPOSITORY, CI_PROJECT_PATH, the Azure DevOps collection URI, the Buildkite organisation slug, the CircleCI project username, the Codespace name and the Gitpod workspace context URL from CI environments
- Read the editor’s own telemetry opt-out setting, checks if it’s enabled, and sends the status
Further analysis indicates that the malicious code has contingency plans in place to query a DNS TXT record to retrieve a fallback exfiltration URL in the event the primary domain is blocked or taken down. The recon variant also features a retry mechanism that triggers the collection later on, suggesting the objective goes beyond a simple one-shot experiment.
“In the recon variant, attempts come at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on every editor restart and giving up only after seven days,” the researchers explained. “A machine that is offline, firewalled, or behind a proxy that drops the first request gets asked again for a week.”
“The recon variant checks whether the open workspace’s own devcontainer.json or .vscode/extensions.json references the extension’s ID, and reports the answer as a single flag. In plain terms, it distinguishes installs that a repository’s configuration caused from installs a human chose. That is the field you would want if the question you were asking was how am I being pulled in, and by what.”
The disclosure comes as 450 unique npm packages spanning 2,244 artifacts have been compromised as part of a new software supply chain attack to deliver an information stealer and leverage the stolen npm token to push trojanized versions containing the same malware. The compromise campaign has been codenamed ChainDrop.
“The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload,” Microsoft said. “The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes.”
“The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.”
Although the tradecraft resembles the tradecraft observed in past Shai-Hulud npm worm activity, the activity remains unattributed at this stage.
“This sample also shows techniques not documented in earlier Shai-Hulud reporting: it downloads a standalone Bun runtime to execute a bundled second stage, uses a modular dispatcher with separate GitHub and domain-based delivery channels, and plants autostart hooks in .claude and .vscode to reach developers and AI coding agents who clone the source,” Socket said.
OX Security noted the ongoing supply chain attacks targeting npm calls for a security layer that goes beyond blocking install scripts and requiring two-factor authentication (2FA) for maintainer accounts.
“It needs granular permission control over what a package can and can’t do,” security researcher Moshe Siman Tov Bustan said. “npm packages should require permission before they can exfiltrate AWS keys and GitHub credentials in a single command.”
