Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
It has been discovered that a group of 77 extensions on the Open VSX marketplace pose as authentic developer tools while sending data on the development environments and systems they were installed on.
Manifold Security claims that the "evil twin" extensions were added to the repository between July 26 and August 1, 2026. As of August 3, 2026, the packages are no longer available in Open VSX.The hostname of the machine is the only information sent in the majority of the packages, according to security experts Ax Sharma and Cody Nash. It provides a thorough description of the machine, the repository that is open in the editor, and the continuous integration system that the editor is operating within in nineteen of them.
Of the extensions found, 58 have been classified as lightweight ...