77 fake developer tools on Open VSX quietly mapped coders' machines for a week

Key points

• Security firm Manifold found 77 counterfeit extensions on the Open VSX marketplace between 26 July and 1 August 2026.
• The fakes copied the names of real developer tools from AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA and a US government namespace.
• 19 of the extensions collected detailed information about developers, their code repositories and their build systems; the other 58 sent only basic machine details.
• All 77 sent data to a single server, mangorbit[.]com, registered on 15 July 2026, eleven days before the campaign began.
• Open VSX removed the packages by 3 August 2026, but installs on developer laptops must be cleaned up by hand.

Someone spent the last week of July uploading 77 fake developer tools to Open VSX, a free marketplace where programmers download add-ons for their code editor. The tools looked legitimate. They weren't.

Manifold Security, which spotted the campaign and shared its findings before pickup by outlets including BleepingComputer, calls this an "evil twin" operation: a counterfeit package that copies the name and description of a real one, hoping a busy developer installs it by mistake. We've been tracking Manifold's work since our first report on 15 July 2026, and this is their most elaborate find yet.

What did the fake extensions actually do?

They watched. Once installed, each extension showed a small "active" indicator in the editor and then sent information about the developer's computer to a server the attacker controlled. None of them delivered the feature they advertised.

58 of the packages kept it light, mainly sending the machine's hostname. The other 19 were far nosier. About four to five seconds after starting up, they pulled the username, operating system, timezone, locale, platform architecture and the full folder path of whatever project the developer had open.

They then inspected the project's hidden .git folder, which every code project keeps, to learn where the code was stored online, which company email the developer used, what branch they were working on, and the exact version of the latest commit. They also enumerated up to 60 other installed extensions and collected identifiers from build services like GitHub, GitLab, Azure DevOps, CircleCI, Buildkite and Gitpod.

Was any source code or password stolen?

No, according to Manifold. The extensions didn't touch source code, saved passwords, login tokens, SSH keys (the digital certificates developers use to prove identity to servers) or browser data. This is reconnaissance, not a smash-and-grab. Think of it as somebody photographing every office in a business park and noting which companies are inside, rather than picking the locks.

Who was being impersonated?

The fakes borrowed names from tools tied to AMD, Microsoft's Azure, Salesforce, Hyperledger, LEGO Education, the IOTA cryptocurrency project and a US government namespace. Most were published under version number 0.0.1, a giveaway if anyone had looked closely, from accounts unconnected to the real developers.

All 77 talked to mangorbit[.]com, registered on 15 July 2026. Subdomains included pulse.mangorbit[.]com, pulse2.mangorbit[.]com, api.mangorbit[.]com and randomised subdomains under cb.mangorbit[.]com. Others queried a DNS TXT record, a small note attached to a domain name, to fetch a fresh address if the main one went down, and variants kept retrying for up to seven days. Each package carried a unique tracking ID so the operator could tell which fake had landed where.

The oddly honest bit

The listings openly stated the extensions collected "anonymous usage metrics" and correctly said they didn't read source code or credentials. Manifold found the extensions sent more than the listings admitted, including build-system details that can expose private repository names. It's unusual for a malicious package to bother with a plausible privacy notice at all, which suggests whoever built this was thinking about longevity, not a quick score.

Manifold hasn't named a suspect and won't speculate on motive. The volume of detail collected fits someone building an organisational map: who works where, on what infrastructure, with which toolchain. Whether a follow-up attack or something else was the goal, nobody outside the operation knows.

Should you check your editor now?

Open VSX removed the 77 packages by 3 August 2026. That doesn't clean them off machines where they were already installed. Manifold recommends checking editor extension lists against the IDs in its report and blocking mangorbit[.]com at the network level.

If you use VS Code, VSCodium or another editor that pulls from Open VSX, open your extensions panel and read the publisher names. A familiar tool name tied to an unfamiliar account is the whole trick, and this campaign shows it works quietly for days before anyone notices.