Open VSX Marketplace Faced 77 Impostors

A campaign involving 77 counterfeit extensions recently targeted the Open VSX marketplace, using identity-spoofing techniques to harvest sensitive metadata from developer environments. Discovered by Manifold Security, these packages were active between July 26 and August 1, 2026.

Impersonation via Evil Twin Tactics

The campaign utilized a strategy where attackers registered counterfeit versions of legitimate extensions. These packages mirrored the names, namespaces, and descriptions of established tools but were published through unrelated, unauthorized accounts. The malicious packages were typically tagged with a version number of 0.0.1, replacing original functional code with scripts designed for data exfiltration.

Instead of providing the services advertised in their marketplace listings, these extensions often displayed a simple status bar message or indicator to suggest they were active. Behind this front, the code established connections to a command-and-control server registered on July 15, 2026, to transmit data from the host machines.

Extensive Data Harvesting Operations

The malicious activity was segmented based on the volume and type of information collected. While 58 extensions focused on limited system details, the remaining 19 performed deeper reconnaissance on developer workspaces. These 19 variants triggered data collection roughly four to five seconds after the extension was activated, gathering information such as:

• Operating system username and hostname
• Machine identifier and platform architecture
• Editor name, version, timezone, and locale
• Workspace file paths
• Git remote hosts, organizations, email domains, and commit hashes
• Enumeration of up to 60 installed extensions
• Identifiers from cloud CI/CD environments

Infrastructure and Persistence Mechanisms

All 77 extensions communicated with the domain mangorbit[.]com. The attackers employed various subdomains, including pulse.mangorbit[.]com, pulse2.mangorbit[.]com, api.mangorbit[.]com, and randomized subdomains under cb.mangorbit[.]com. Each specific package contained its own unique tracking identifier, allowing operators to monitor which counterfeit extension was installed on a victim's machine.

The campaign was designed to be resilient. Some variants were configured to attempt transmission of collected data for a period of up to seven days. Additionally, the malware could query DNS TXT records to receive a replacement URL if the primary infrastructure went offline.

Disclosures Versus Actual Behavior

A notable aspect of this campaign was the inclusion of marketplace disclosures that claimed the extensions collected "anonymous usage metrics." While the listings accurately stated that the extensions did not access source code, credentials, authentication tokens, or SSH material, the actual data transmitted to the attackers included CI information that could potentially expose private repository structures.

Remediation and System Cleanup

Although the 77 malicious packages were removed from the Open VSX marketplace by August 3, 2026, their removal from the registry does not automatically purge them from individual machines. Developers are advised to audit their systems and workspace configurations to identify and remove any extensions that correspond to the malicious IDs identified in the report. Security teams are also encouraged to block traffic to the mangorbit[.]com domain.

Implications for Development Security

This incident illustrates the risks inherent in third-party extension marketplaces, where even tools that appear to disclose their telemetry can be leveraged to profile private infrastructure. For organizations, the exposure of CI/CD metadata and Git configuration details could provide attackers with the intelligence needed for future, more targeted operations. The event underscores that verifying the provenance of development tools, rather than relying on provided disclosures, remains a necessary component of securing software build pipelines.