---
title: "Open VSX: 77 Evil-Twin Extensions Leak Developer Data"
url: https://erroneo.us/security/briefs/open-vsx-evil-twin-extensions-mangorbit/
description: "77 Open VSX extensions cloned real tools and beaconed to mangorbit[.]com; 19 sent repo and CI details. Removed Aug 3, but installed copies keep running."
type: security-brief
section: "Security Digest"
date_published: 2026-08-04
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "medium"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Open VSX: 77 Evil-Twin Extensions Leak Developer Data

**Verdict: Check exposure.** Check whether any of the 77 extension IDs are installed or recommended in your workspaces and remove them; this was reconnaissance, not credential theft, so blanket secret rotation is not needed.

- **Who must act:** Developers and teams whose editors install extensions from Open VSX, especially where workspace or devcontainer files auto-install recommended extensions in CI or cloud dev environments.
- **Who can relax:** VS Code users who install only from Microsoft's Visual Studio Marketplace, and teams that pin Open VSX extensions by verified publisher and version.
- **Affected:** Any of the 77 extension IDs in Manifold Security's list, installed from Open VSX between Jul 26 and Aug 3, 2026; 19 'Payload B' extensions (for example amd.gaia-vscode, iotaledger.iota-move, ssagov.uef-snippets, configcat.configcat-feature-flags) that sent repository and CI details; 58 'Payload A' extensions that sent mostly the hostname
- **Fixed:** Removed from Open VSX by Aug 3, 2026 and added to its malicious extension list; Installed copies are not removed automatically; uninstall them
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. List installed extensions (codium --list-extensions --show-versions, or your editor's equivalent) and compare them with Manifold's published list and Open VSX's malicious list.
2. Search repositories and dev images for the IDs in .vscode/extensions.json, .devcontainer/devcontainer.json and .devcontainer.json, and remove them.
3. Uninstall any match (codium --uninstall-extension <id>) and rebuild dev containers or CI images that baked it in.
4. Block *.mangorbit.com at DNS and proxy level.
5. Pin Open VSX installs by publisher and version, and treat an unverified-publisher listing as a hard stop in automated installs.

### How to check if you are affected

- Search DNS and proxy logs for pulse.mangorbit.com, pulse2.mangorbit.com, api.mangorbit.com and *.cb.mangorbit.com.
- Look for DNS TXT queries for _beacon.<domain>, and HTTP requests to /api/v1/metrics or /api/v1/events with User-Agent vscode-ext-metrics/1.0.
- Compare installed extension IDs and VSIX SHA-256 hashes with Manifold's CSV.

## What happened

On August 4, 2026, [Manifold Security](https://www.manifold.security/blog/open-vsx-evil-twin-extensions) reported 77 counterfeit extensions published to Open VSX between July 26 and August 1. The open-source extension registry run by the Eclipse Foundation serves VSCodium and other VS Code-compatible editors. Each counterfeit reused the name, namespace and description of a real VS Code Marketplace extension that its owner had never claimed on Open VSX. Most carried version 0.0.1, and the original `extension.js` was replaced with telemetry code. Impersonated names included AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA and a U.S. government agency namespace.

All 77 reported to one domain, `mangorbit[.]com`, which was registered on July 15. Open VSX added the IDs to its [malicious extension list](https://github.com/EclipseFdn/publish-extensions/blob/master/extension-control/extensions.json); for example, the [August 1 commit](https://github.com/EclipseFdn/publish-extensions/commit/9baa4b2cf520a6cf51cfee256350114fe305176f) includes `amd.gaia-vscode`, `iotaledger.iota-move` and `ssagov.uef-snippets`. All 77 were gone from the registry by August 3. Manifold did not attribute the campaign.

## Who is affected

Anyone who installed one of the IDs from Open VSX during that window. Manifold sorted them into two groups:

- **58 beacons ("Payload A"):** they sent mostly the hostname, sometimes the workspace folder name or editor version, plus a per-package tracking ID.
- **19 reconnaissance payloads ("Payload B"):** they sent the OS username, machine ID, workspace name and full path, and git remote host and organization. They also sent the commit email domain, branch, HEAD SHA, up to 60 installed extension IDs, and CI identity values such as `GITHUB_REPOSITORY` and `CI_PROJECT_PATH`. Those values can reveal private repository names.

Some variants retried for up to seven days and could fetch a replacement endpoint from a DNS TXT record. Install counts were not disclosed as of October 21, 2026.

## Do you really need to act?

Check, yes. Panic, no. Manifold compared the listings' claims against the code and found that source code, credentials, tokens, SSH keys and browser data were not collected. Repository URLs had credentials stripped before sending. The real harm is a map of who works on what: private repository and organization names, CI systems and machine identities. That map is useful for targeting a later attack. Blanket secret rotation is not warranted by what was found.

The catch is persistence. Removal from the registry does not uninstall anything. A machine, dev container or CI image that pulled one of these IDs keeps running the beacon every time the editor starts. That includes images built from a workspace's recommended-extensions file. Because the attackers squatted names that real projects later claimed, an ID alone is not proof of malice. [Socket](https://socket.dev/blog/open-vsx-unblocks-malicious-extension-ids) notes that Open VSX unblocked three IDs between August 16 and 20 once their legitimate owners took them over. Check the version and publisher too.

## What to do now

1. List what is installed: `codium --list-extensions --show-versions` (or your editor's equivalent). Compare the output with Manifold's list.
2. Search repositories and images for the IDs: `grep -rn -e amd.gaia-vscode -e iotaledger.iota-move .vscode .devcontainer .devcontainer.json`, extended with the full list.
3. Uninstall matches with `codium --uninstall-extension <id>`, then rebuild any dev container or CI image that baked them in.
4. Block `*.mangorbit.com` at DNS and proxy level. That covers every sample.
5. Pin Open VSX extensions by publisher and version, and fail automated installs from unverified publishers.

## How to tell if you were hit

Search DNS and proxy logs since July 26 for `pulse.mangorbit.com`, `pulse2.mangorbit.com`, `api.mangorbit.com` and random subdomains of `cb.mangorbit.com`. Also search for TXT lookups of `_beacon.*`, and HTTP requests to `/api/v1/metrics` or `/api/v1/events` with the User-Agent `vscode-ext-metrics/1.0`. If a CI runner or cloud workspace ran one of the 19 reconnaissance extensions, assume its repository name and CI identity were sent. Manifold publishes SHA-256 hashes for every VSIX, so you can confirm a match.

## Timeline

- Jul 15, 2026 — mangorbit[.]com is registered.
- Jul 26 – Aug 1, 2026 — The 77 extensions appear on Open VSX.
- Aug 1, 2026 — Open VSX adds campaign IDs to its malicious extension list.
- Aug 3, 2026 — All 77 are removed from the registry.
- Aug 4, 2026 — Manifold publishes its findings, and [BleepingComputer](https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/) reports them.
- Aug 16–20, 2026 — Open VSX unblocks three IDs claimed by their legitimate owners, as later reported by [The Hacker News](https://thehackernews.com/2026/08/open-vsx-removes-77-malicious-evil-twin.html).

## Sources

1. [Manifold Security — 77 'Evil Twin' Open VSX Extensions: 19 Copy Private Repo and CI Data to a New Domain](https://www.manifold.security/blog/open-vsx-evil-twin-extensions)
2. [Eclipse Foundation / Open VSX — 'Update malicious extensions list' commit (Aug 1, 2026)](https://github.com/EclipseFdn/publish-extensions/commit/9baa4b2cf520a6cf51cfee256350114fe305176f)
3. [Eclipse Foundation / Open VSX — extension-control/extensions.json (malicious list)](https://github.com/EclipseFdn/publish-extensions/blob/master/extension-control/extensions.json)
4. [Socket — Open VSX unblocks malicious extension IDs](https://socket.dev/blog/open-vsx-unblocks-malicious-extension-ids)
5. [BleepingComputer — 77 Open VSX extensions found harvesting developer info](https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/)
6. [The Hacker News — Open VSX removes 77 malicious 'evil twin' extensions](https://thehackernews.com/2026/08/open-vsx-removes-77-malicious-evil-twin.html)

---
Source page: https://erroneo.us/security/briefs/open-vsx-evil-twin-extensions-mangorbit/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt