77 fake developer tools on Open VSX quietly mapped coders' machines for a week

Key points

• Security firm Manifold found 77 counterfeit extensions on the Open VSX marketplace between 26 July and 1 August 2026.
• The fakes copied the names of real developer tools from AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA and a US government namespace.
• 19 of the extensions collected detailed information about developers, their code repositories and their build systems; the other 58 sent only basic machine details.
• All 77 sent data to a single server, mangorbit[.]com, registered on 15 July 2026, 11 days before the campaign began.
• Open VSX removed the packages by 3 August 2026, but installs on developer laptops must be cleaned up by hand.

Someone spent the last two weeks of July uploading 77 fake developer tools to Open VSX, a free marketplace where programmers download add-ons for their code editor. The tools looked legitimate. They were not.

Manifold Security, which spotted the campaign and first shared its findings before pickup by outlets including BleepingComputer, calls this an "evil twin" operation. That is exactly what it sounds like: a counterfeit package that copies the name, description and branding of a real one, hoping a busy developer installs it by mistake.

What did the fake extensions actually do?

They watched. Once installed, each extension showed a small "active" indicator in the editor and then sent information about the developer's computer to a server the attacker controlled. None of them delivered the feature they advertised.

58 of the packages kept it light, mostly sending the machine's name. The other 19 were far nosier. About four seconds after starting up, they pulled the username, operating system, timezone, editor version, and the full folder path of whatever project the developer had open.

They then poked around the project's hidden .git folder, which every code project keeps, to learn where the code was stored online, which company email the developer used, what branch they were working on, and the exact version of the latest change.

For good measure, they listed up to 60 other extensions installed alongside them, and picked up identifiers from build services like GitHub, GitLab, Azure DevOps, CircleCI, Buildkite, GitHub Codespaces and Gitpod.

Was any source code or password stolen?

No, according to Manifold. The extensions did not touch source code, saved passwords, login tokens, SSH keys (the digital keys developers use to prove who they are to servers), or browser data. This is closer to a very thorough reconnaissance job than a smash-and-grab.

Think of it as somebody photographing the outside of every office in a business park, noting which companies rent which units and what deliveries arrive, rather than picking the locks.

Who was being impersonated?

The fakes borrowed names from tools tied to AMD, Microsoft's Azure, Salesforce, Hyperledger, LEGO Education, the IOTA cryptocurrency project, and a US government namespace. Most were published under the version number 0.0.1, a giveaway if anyone had looked closely, and came from accounts unconnected to the real developers.

All 77 talked to the same domain, mangorbit[.]com, registered on 15 July 2026. That is 11 days before the first fake extension appeared. Some samples used subdomains like pulse.mangorbit[.]com; others queried a DNS TXT record, a small note attached to a domain name, to fetch a fresh address if the main one went down. Some kept retrying for up to seven days.

Each package carried a unique tracking ID, so the operator could tell which fake had landed on which machine.

The oddly honest bit

Here is the twist. The listings openly said the extensions collected "anonymous usage metrics" and correctly stated they did not read source code or credentials. Manifold found that the extensions did send more than the listings admitted, including build-system details that can leak private repository names. Still, it is unusual for a malicious package to bother with a plausible privacy notice at all.

Manifold has not named a suspect and will not guess at motive. The volume of detail collected is consistent with someone building a map of who works where, on what, and with which tools. Whether that map is for a follow-up attack, a sales pitch, or something else, nobody outside the operation knows yet.

What should developers do?

Open VSX removed the 77 packages by 3 August 2026. That does not clean them off machines where they were already installed. Manifold recommends checking editor extension lists against the IDs in its report and blocking the mangorbit[.]com domain at the network level.

If you use VS Code, VSCodium or another editor that pulls from Open VSX, open your extensions panel this week and read the publisher names. A familiar name from an unfamiliar account is the whole trick.