Open VSX purges 77 extensions that collected developer and CI data
Open VSX removed 77 malicious extensions by August 3, 2026, after Manifold Security found that they impersonated legitimate developer tools and transmitted information from systems where they were installed. The packages appeared between July 26 and August 1; 58 mainly collected hostnames, while 19 gathered broader details about developer machines, repositories, editors and CI environments.
The extensions reused the names, namespaces and descriptions of genuine Open VSX listings, but unrelated accounts published them, commonly with a low version number such as 0.0.1. They did not provide the functionality advertised in their listings. Instead, they displayed an active status message and initiated data collection.
What the extensions collected
The lighter group sent a machine hostname and, in some cases, the workspace folder name or editor version. The reconnaissance group could transmit the operating-system username; editor name, version, host kind and machine ID; platform and architecture; locale and timezone; and the open workspace's folder name and full file-system path.
The more capable variant also inspected the workspace's .git directory for remote hosts and organizations, the domain in the developer's configured email, the current branch and the HEAD commit SHA. It enumerated up to 60 installed extension IDs, collected the proxy hostname and identified CI markers.
Its CI collection included values associated with GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces and Gitpod. It also read the editor's telemetry opt-out setting and reported whether it was enabled.
Shared infrastructure and persistence
All 77 extensions sent data to mangorbit[.]com, a domain registered on July 15, 11 days before the first malicious packages appeared. The groups shared code and behavioral similarities, and their bundled extension.js files had been replaced with collection logic presented as anonymous usage metrics.
The reconnaissance variant could query a DNS TXT record for a fallback exfiltration address if the primary domain was unavailable. Failed collection attempts were retried after roughly 15 minutes, 50 minutes and three and a half hours, then every seven or eight hours. Attempts resumed after editor restarts and continued for as long as seven days.
It also checked whether devcontainer.json or .vscode/extensions.json referenced its own extension ID. That flag could distinguish an installation prompted by repository configuration from one selected directly by a developer. The campaign therefore illustrates how borrowed trust in cybersecurity campaigns can exploit familiar identities while collecting signals about how a package reached its target.
A broader supply-chain warning
The disclosure coincided with ChainDrop, a separate campaign that compromised 450 unique npm packages across 2,244 artifacts. Microsoft said its Mini Shai-Hulud variant used a preinstall hook to run an obfuscated Bun-based JavaScript payload, steal credentials and use npm tokens to publish trojanized releases.
For businesses, extension marketplaces should be managed like other software supply chains. Security teams should verify publishers and version histories, maintain an inventory of editor add-ons, inspect outbound DNS and web traffic, and investigate systems that installed matching packages during the publication window.