Loading story…
Researchers uncovered a campaign of 77 malicious "evil twin" extensions on the Open VSX marketplace that impersonated legitimate developer tools and quietly exfiltrated host and development-environment metadata. Manifold Security linked the packages through shared code, behavior, and communications with mangorbit[.]com, finding that 58 extensions gathered basic system details while 19 conducted broader reconnaissance. Open VSX removed the packages by August 3 after the activity was identified between July 26 and August 1.
The more invasive extensions collected information including Git metadata, workspace paths, installed extensions, and identifiers tied to CI and cloud development environments, giving attackers enough data to profile developers, organizations, and potentially private repositories. Researchers said the campaign did not access source code, credentials, authentication tokens, SSH keys, or browser data, but warned that affected users still need to manually uninstall the extensions from their systems and block the campaign domain to prevent further data collection.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
On August 4, 2026, Ax Sharma and Cody Nash of Manifold Security published research documenting the 77 counterfeit Open VSX extensions, their impersonation of legitimate VS Code Marketplace listings, and their data-exfiltration behavior tied to mangorbit.com.
Open VSX had removed the 77 malicious extensions by August 3, 2026. Affected users still needed to manually remove installed extensions and block the campaign domain.
Between August 16 and August 20, 2026, Open VSX removed three extension IDs from its malicious-extension list after legitimate maintainers proved ownership of projects previously impersonated in the 77-extension campaign. The change allowed legitimate publishers to reclaim and, in two cases, republish extensions under identifiers that had earlier been used by malware.
The exfiltration domain mangorbit[.]com used by the malicious Open VSX extensions was registered eleven days before the first packages appeared. Manifold linked all 77 extensions to infrastructure under this domain.
Between July 26 and August 1, 2026, Manifold Security discovered 77 malicious extensions on the Open VSX marketplace. The packages were linked through shared code, behavior, and mangorbit[.]com infrastructure.
Analysis by Ax Sharma and Cody Nash found that 19 of the 77 malicious Open VSX extensions gathered extensive Git, CI, installed-extension, proxy, and telemetry-setting data. These variants also used staged retry logic for up to seven days and could fetch an alternate exfiltration URL via DNS TXT records if the primary domain was blocked.
The first malicious Open VSX packages in the "evil twin" campaign appeared after the mangorbit[.]com domain was registered. The extensions impersonated legitimate developer tools and were published from unrelated accounts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
10 references tracked. Mallory keeps watching after this page renders.
socket.dev
Open sourcetechrepublic.com
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcemanifold.security
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered a coordinated campaign by the threat actor group TigerJack, which targets developers by publishing malicious extensions on both Microsoft's Visual Studio Code (VSCode) Marketplace and the OpenVSX registry. The campaign involves at least 11 different extensions distributed across multiple publisher accounts, with some extensions accumulating over 17,000 downloads before being removed from the official VSCode Marketplace. Despite removal from Microsoft's platform, these extensions remain active and available on the OpenVSX marketplace, which is used by alternative VSCode-compatible editors such as Cursor and Windsurf. The malicious extensions serve various purposes, including exfiltrating developers' source code, mining cryptocurrency using the host's resources, and maintaining persistent remote access. For example, the 'C++ Playground' extension registers a listener to capture and exfiltrate C++ source code in near real-time, while the 'HTTP Format' extension secretly runs a CoinIMP cryptominer in the background, consuming the host's processing power without restrictions. Some variants of the extensions are capable of fetching and executing remote JavaScript code, allowing TigerJack to dynamically update their payloads and potentially deploy additional threats such as credential stealers, ransomware, or API-harvesting scripts. The campaign demonstrates a high level of persistence, with TigerJack repeatedly re-uploading the same malicious code under new names and accounts after takedowns. The extensions are designed to appear as legitimate developer tools, increasing the likelihood of installation by unsuspecting users. The use of OpenVSX as a distribution channel poses a significant risk, as it is less regulated than Microsoft's marketplace and serves as the default for several popular IDEs. Researchers from Koi Security have been actively tracking the campaign and have highlighted the ongoing threat posed by these extensions, especially given their ability to maintain remote control and adapt their functionality without requiring updates. The campaign underscores the risks associated with third-party extension marketplaces and the importance of vetting and monitoring developer tools for malicious behavior. The technical sophistication of the extensions, particularly their ability to execute remote code and evade detection, raises concerns about long-term supply chain compromise within the developer ecosystem. Organizations and individual developers are advised to review installed extensions, monitor for suspicious activity, and prioritize security hygiene when sourcing tools from community-driven marketplaces. The continued presence of these extensions on OpenVSX, despite removal from the official VSCode Marketplace, highlights the challenges in fully eradicating such threats from the software supply chain. Security experts warn that the campaign is ongoing, with TigerJack actively seeking new ways to distribute their malicious payloads and compromise developer environments.
Jun 29, 2026
Eclipse Foundation revoked a small number of leaked access tokens for the Open VSX extension marketplace after a report from Wiz revealed that several Visual Studio Code extensions had inadvertently exposed their tokens in public repositories. This exposure could have allowed attackers to take control of extensions and distribute malware, posing a significant supply chain risk. The foundation confirmed that the leaks were due to developer mistakes, not a compromise of Open VSX infrastructure, and has since implemented new security measures, including a token prefix format and reduced token lifetimes. Additionally, extensions flagged as part of the "GlassWorm" campaign by Koi Security were removed, and the foundation clarified that the reported download numbers were likely inflated by bots and threat actor tactics. The GlassWorm campaign involved the use of hidden malicious code injected with invisible Unicode Private Use Area (PUA) characters, a technique previously observed in npm packages and now seen in compromised Open VSX extensions. Security researchers noted that the same threat actor has shifted focus to GitHub repositories, using increasingly stealthy methods to inject malware into legitimate-looking commits. The campaign highlights the evolving tactics of supply chain attackers and the importance of proactive security measures in open-source ecosystems.
Jun 29, 2026
A supply-chain compromise of the **Open VSX Registry** led to malicious updates being pushed to legitimate Visual Studio Code extensions after attackers gained access to a developer’s publishing credentials (likely via a leaked token or other unauthorized access). Reporting indicates four established extensions from the `oorzc` publisher were trojanized and distributed via Open VSX before being removed, with prior legitimate adoption measured in the tens of thousands of downloads and subsequent exposure affecting downstream developer environments. The injected payload delivered the **GlassWorm** malware/loader, which executes via obfuscated JavaScript embedded in the extension and includes environment checks (notably avoiding execution on **Russian-locale** systems). Technical details describe a multi-stage loader with capabilities aligned to credential and data theft, including macOS credential and cryptocurrency wallet targeting, and use of techniques such as **EtherHiding** to retrieve command-and-control infrastructure dynamically; defenders are advised to identify and remove affected extension versions and review developer endpoints for signs of compromise and credential/token leakage.
Jun 29, 2026