mangorbit.com

A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of August 3, 2026. "In most of the packages it sends little more than the machine's hostname," security researchers Ax Sharma and Cody Nash said. "In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside." Of the identified extensions, 58 have been described as lightweight tools designed to exfiltrate the hostname and, in some cases, the workspace folder name or editor version. The rest are reconnaissance payloads that transmit the developer-related information: local hostname and operating system username, the editor's name, version, host kind and machine ID, the platform and architecture, the locale and timezone, and the open workspace's folder name and full file system path. Both share the same data-exfiltration domain, as well as similarities in code and behavior. The names of the 19 extensions are listed below - amd.gaia-vscode artsy.artsy-studio-extension-pack configcat.configcat-feature-flags iotaledger.iota-move marketplace.visualstudio obyte.oscript-vscode-plugin openeuphoria.vscode-euphoria oss.sfmc-devtools-vscode rumbledb.jsoniq-vscode ssagov.uef-snippets taskfile.vscode-task doi.fileheadercomment mengsiCode.vscode-django-boilerplate move.move-analyzer uavcan.dsdl vs-publisher-988541.apexsql-power-tools casualjim.gotemplate jcamp.dotnet-test-provider-view superposition.supertoml-analyzer What's notable about the campaign is that it reuses the names, namespaces, and descriptions of real Microsoft VS Code Marketplace extensions, but they are published through unrelated accounts and assigned a low version number (e.g., 0.0.1). The main change involves swapping the contents of the bundled "extension.js" file with capabilities to capture and transmit data, while framing the collection as "anonymous usage metrics." None of the extensions offer the advertised functionality mentioned in their listings. Instead, they display a status bar item along with a message that states they are active, before firing the data exfiltration step. In all 77 extensions, the data is sent to "mangorbit[.]com," which was registered on July 15, 2026, 11 days before the first packages were published. The extensions that are part of the second set cluster have also been found to carry out the following steps - Inspect files in the workspace's .git directory to obtain Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the HEAD commit SHA hash. Enumerate up to 60 installed extension IDs and pick up the proxy hostname from the environment Extract the names of any CI markers present, and separately the values of GITHUB_REPOSITORY, CI_PROJECT_PATH, the Azure DevOps collection URI, the Buildkite organisation slug, the CircleCI project username, the Codespace name and the Gitpod workspace context URL from CI environments Read the editor's own telemetry opt-out setting, checks if it's enabled, and sends the status Further analysis indicates that the malicious code has contingency plans in place to query a DNS TXT record to retrieve a fallback exfiltration URL in the event the primary domain is blocked or taken down. The recon variant also features a retry mechanism that triggers the collection later on, suggesting the objective goes beyond a simple one-shot experiment. "In the recon variant, attempts come at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on every editor restart and giving up only after seven days," the researchers explained. "A machine that is offline, firewalled, or behind a proxy that drops the first request gets asked again for a week." "The recon variant checks whether the open workspace's own devcontainer.json or .vscode/extensions.json references the extension's ID, and reports the answer as a single flag. In plain terms, it distinguishes installs that a repository's configuration caused from installs a human chose. That is the field you would want if the question you were asking was how am I being pulled in, and by what." The disclosure comes as 450 unique npm packages spanning 2,244 artifacts have been compromised as part of a new software supply chain attack to deliver an information stealer and leverage the stolen npm token to push trojanized versions containing the same malware. The compromise campaign has been codenamed ChainDrop. "The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload," Microsoft said. "The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes." "The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path." Although the tradecraft resembles the tradecraft observed in past Shai-Hulud npm worm activity, the activity remains unattributed at this stage. "This sample also shows techniques not documented in earlier Shai-Hulud reporting: it downloads a standalone Bun runtime to execute a bundled second stage, uses a modular dispatcher with separate GitHub and domain-based delivery channels, and plants autostart hooks in .claude and .vscode to reach developers and AI coding agents who clone the source," Socket said. OX Security noted the ongoing supply chain attacks targeting npm calls for a security layer that goes beyond blocking install scripts and requiring two-factor authentication (2FA) for maintainer accounts. "It needs granular permission control over what a package can and can't do," security researcher Moshe Siman Tov Bustan said. "npm packages should require permission before they can exfiltrate AWS keys and GitHub credentials in a single command."

77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed. The so-called "evil twin" campaign was discovered by Manifold Security, which detected the extensions between July 26 and August 1, 2026. Researchers linked all 77 extensions to the same activity through a shared data-exfiltration domain, as well as code and network behavior. While 58 extensions sent only a small amount of system information, the remaining 19 contained more extensive reconnaissance that exfiltrated developer, Git repository, and continuous integration (CI) metadata. However, Manifold found that the extensions did not access source code, credentials, authentication tokens, SSH material, or browser data, and declined to speculate on the campaign's purpose. Evil Twin extensions linked through shared infrastructure An "evil twin" extension is a counterfeit package that copies the identity of a legitimate extension to trick people into installing it. In this campaign, the packages reused the names, namespaces, and descriptions of real VS Code Marketplace extensions but were published through unrelated accounts. Most were assigned the low version number 0.0.1, while the legitimate extension's bundled extension.js file was replaced with code designed primarily to collect and transmit data. Manifold says the extensions did not provide the functionality advertised in their listings and instead displayed a status bar indicator or message saying the extension was active before transmitting data to the attacker's server. The packages impersonated extensions associated with a wide range of technologies and organizations, including AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and a U.S. government agency namespace. All 77 extensions communicated with a server at mangorbit[.]com, which was registered on July 15, 2026, eleven days before the first packages appeared. Manifold says that most samples contacted pulse.mangorbit[.]com or pulse2.mangorbit[.]com, while others used api.mangorbit[.]com or randomized subdomains under cb.mangorbit[.]com. Each package included its own tracking identifier, allowing the operator to determine which counterfeit extension had been installed. Fifty-eight of the extensions contained payloads that mainly exfiltrated the machine's hostname, with some variants also sending the workspace folder name and editor version. The other 19 extensions collected significantly more information approximately four to five seconds after activation, including the operating system username and hostname, machine identifier, editor name and version, platform architecture, locale, timezone, and the name and full filesystem path of the workspace open in the editor. The extensions also inspected some files in the workspace's .git directory to obtain Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the HEAD commit hash. They enumerated up to 60 installed extensions and collected identifiers from CI and cloud development environments, including GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, GitHub Codespaces, and Gitpod. What is unusual about this campaign is that the Open VSX listings disclosed that they collected what they called "anonymous usage metrics" and accurately said they did not access source code or credentials. However, Manifold reports that the extensions sent more data than disclosed, including CI information that could expose private repository names or paths. Some also checked whether they had been installed manually or automatically through a project configuration. Some variants were designed to keep trying to transmit the collected data for up to seven days. They also supported multiple collection endpoints and could query a DNS TXT record for a replacement URL if the hardcoded infrastructure stopped responding. Manifold did not attribute the campaign and declined to speculate on the operator’s intent. However, the 19 reconnaissance extensions collected enough metadata to profile organizations, development environments, and private repositories. The packages were removed from Open VSX by August 3, 2026, but the packages would still need to be manually removed from developers' systems and applications. Manifold recommends checking systems and workspace configuration files for extension IDs listed in its report and blocking the mangorbit[.]com domain, which is used by all 77 packages in the campaign. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report