77 Open VSX Extensions Collected Developer and Environment Data

Aug 4, 2026 · Original article ↗

Summary

Manifold Security linked 77 counterfeit Open VSX extensions to shared infrastructure. Nineteen reportedly collected detailed Git, CI, and workspace metadata; the packages were removed, but developers may need to uninstall them manually.

Key points

Manifold Security detected the extensions between July 26 and August 1, 2026; Open VSX had removed them by August 3.
The counterfeit extensions impersonated legitimate packages and sent collected data to mangorbit[.]com and related subdomains.
Fifty-eight extensions mainly collected a machine hostname; 19 gathered more extensive system, workspace, Git, and CI metadata.
Manifold reported that the extensions did not access source code, credentials, authentication tokens, SSH material, or browser data.
Some variants retried data transmission for up to seven days and could query a DNS TXT record for a replacement URL.
Manifold did not identify the operator or speculate on its intent; it recommends checking for listed extension IDs and blocking mangorbit[.]com.

Article Details

Event Type: Malicious extension campaign targeting the Open VSX marketplace
Impact: Seventy-seven counterfeit extensions collected and exfiltrated system and development-environment data. Nineteen gathered more extensive Git, CI, and workspace metadata, which could expose private repository names or paths. Manifold Security reports that the extensions did not access source code, credentials, authentication tokens, SSH material, or browser data.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`mangorbit[.]com`	Shared attacker infrastructure used by all 77 extensions to exfiltrate collected data.
HOSTNAME	`api[.]mangorbit[.]com`	Attacker infrastructure used by some campaign samples for data exfiltration.
HOSTNAME	`cb[.]mangorbit[.]com`	Attacker-controlled subdomain namespace used by some samples for randomized callback infrastructure.
HOSTNAME	`pulse[.]mangorbit[.]com`	Attacker infrastructure contacted by most campaign samples to transmit collected data.
HOSTNAME	`pulse2[.]mangorbit[.]com`	Attacker infrastructure contacted by most campaign samples to transmit collected data.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe extensions exfiltrated collected system and development-environment data to attacker infrastructure.

Products

Open VSX77 Open VSX extensions impersonated legitimate developer tools in an “evil twin” campaign and sent system and development-environment data to attacker infrastructure.