A wave of counterfeit Open VSX extensions has exposed how easily a familiar developer tool can become a data collection channel.
Seventy-seven packages copied the names, namespaces, and descriptions of legitimate extensions, then contacted the same newly registered domain.
The campaign appeared between July 26 and August 1, 2026. Most packages sent basic device details, but 19 contained a far more intrusive reconnaissance routine that collected repository and continuous integration information from developer workstations and build environments.
Researchers at Manifold identified the operation and found that the packages were published by accounts unrelated to extension authors.
Manifold said in a report shared with Cyber Security News (CSN) that the listings presented the activity as telemetry, a label that concealed the real reach of the code.
ciIdentity() function within extension.js collecting CI identity data (Source – Manifold)
Private repository names, project paths, branch details, and CI identifiers can reveal an organisation’s internal development work, making it useful for targeted phishing, follow-on intrusion attempts, or mapping a software supply chain.
77 Evil Twin Open VSX Extensions
The rogue packages used a simple but effective impersonation method. They reused familiar extension identities, often at version 0.0.1, while replacing the extension.js content with code designed to beacon information outward.
This mirrors the risk seen in malicious VSCode marketplace extensions, where familiar tools can mask harmful behavior.
Fifty-eight of the packages were lightweight beacons that reported a hostname and sometimes a workspace folder or editor version.
The 19 reconnaissance variants activated within seconds and gathered the hostname, operating-system username, editor details, device identifiers, location settings, workspace name, and full local path.
The more serious variants also inspected Git metadata. They pulled the host and organisation from origin and upstream remote URLs, the domain portion of the configured commit email, the current branch, and the latest commit identifier.
Notice the ‘telemetry’ section on the extension’s readme webpage (Source – Manifold)
On a build runner, CI variables could expose the full name or path of a private repository. The code checked for values for GitHub Actions, GitLab CI, Azure DevOps, Buildkite, CircleCI, Codespaces, and Gitpod.
It also listed installed extensions and read the editor’s telemetry preference, but transmitted the collected information even when that setting indicated an opt-out.
That behavior is especially troubling because the marketplace pages claimed CI values would remain on the machine.
The researchers found code sent both CI marker names and their values. Readers tracking the broader trend can see similar supply-chain exposure in trusted developer tooling attacks.
Persistence Raises Supply Chain Risk
The infrastructure was designed for persistence. Packages used multiple hosts under the same domain, retried connections for up to seven days, and treated any HTTP response as a successful delivery.
If hardcoded endpoints failed, the code could query DNS TXT records for a replacement collection address.
This matters because extension installation is increasingly automated. Devcontainer configurations, editor setup scripts, and provisioning workflows may install an extension by name without checking publisher ownership, download history, or project lineage.
The problem resembles recent Open VSX sleeper extensions, which showed how malicious packages can wait inside development ecosystems.
As of August 3, the packages had been removed from Open VSX, but removal does not erase code already placed in workstation images, build systems, or repository configuration.
Teams should search developer and CI images for matching entries in .vscode/extensions.json, .devcontainer/devcontainer.json, and .devcontainer.json, then verify the extensions installed.
Organisations should block the identified domain, pin internally mirrored packages by publisher and version, and treat unverified publisher warnings as a stopping point for automated installations.
Security teams should also alert on editor processes contacting newly registered domains shortly after startup and on DNS TXT lookups using _beacon labels.
The incident reinforces that code editor extensions deserve the same scrutiny as any other software dependency.
Reviewing runtime behavior, controlling automated installs, and validating publisher identity can reduce the chance that a copied name becomes a route into private engineering data across distributed software development teams globally.
Indicators of compromise (IoCs):-
TypeIndicatorDescriptionDomainmangorbit[.]comPrimary campaign domain used by all 77 identified packagesHostpulse.mangorbit[.]comBeacon collection endpointHostpulse2.mangorbit[.]comSecondary beacon collection endpointHostapi.mangorbit[.]comBeacon endpoint used by one observed sampleHost pattern*.cb.mangorbit[.]comRandomised callback subdomains used by one observed sampleURI path/t/<24-hex tracking id>Tracking endpoint pathURI path/api/v1/metricsMetrics collection endpointURI path/api/v1/eventsEvent collection endpointDNS TXT query_beacon.<domain>Mechanism used to retrieve a replacement collection URLDNS TXT response patternbase= expected in the TXT-record responseUser-Agentvscode-ext-metrics/1.0User-Agent used for outbound beacon trafficFile nameextension.jsModified extension file containing beacon and reconnaissance codeMalicious extension IDlego-education.ev3-micropython version 0.0.2Observed counterfeit Open VSX extensionMalicious extension IDbetter-ts-errors.better-ts-errors version 0.0.1Observed counterfeit Open VSX extensionMalicious extension IDgroksrc.ruby version 0.0.1Observed counterfeit Open VSX extensionMalicious extension IDmaptz.regionfolder version 0.0.1Observed counterfeit Open VSX extensionMalicious extension IDmitsuhiko.insta version 0.0.1Observed counterfeit Open VSX extensionMalicious extension IDSBSnippets.pytorch-snippets version 0.0.1Observed counterfeit Open VSX extensionMalicious extension IDslb235.vscode-coffeelint version 0.0.1Observed counterfeit Open VSX extensionMalicious extension IDamd.gaia-vscode version 0.0.1Observed reconnaissance extensionMalicious extension IDartsy.artsy-studio-extension-pack version 0.0.1Observed reconnaissance extensionMalicious extension IDconfigcat.configcat-feature-flags version 0.0.1Observed reconnaissance extension
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
The post 77 Evil Twin Open VSX Extensions Exfiltrate Private Git Repository and CI Data appeared first on Cyber Security News.
