Bottom line: Manifold Security uncovered 77 fake developer extensions on Open VSX that exfiltrated system and environment data between July 26 and August 1, 2026, before being removed.
The Open VSX marketplace has removed 77 extensions that mimicked legitimate developer tools while harvesting information about users’ systems and development environments. The findings come from Manifold Security and cover a distribution window between July 26 and August 1, 2026.
Security researchers at Manifold Security identified a group of 77 extensions on the Open VSX marketplace that posed as well-known, legitimate developer tools. These so-called “evil twin” packages were uploaded during the period from July 26 to August 1, 2026. They transmitted information about the systems and development environments on which they were installed to attackers.
Open VSX is an open marketplace for extensions used by, among others, VS Code-compatible editors such as VSCodium, Gitpod and Eclipse Theia. Because the platform serves as an open alternative to the official Visual Studio Code Marketplace, many development teams and CI/CD environments rely on it without it going through the same curation and vetting mechanisms as proprietary stores. A successful attack at this level can directly impact developer environments and downstream build pipelines.
For engineering teams, this case means that name similarity to well-known tools (“evil twin”) alone is not a trust signal. Before installing extensions from Open VSX, the publisher name, download history and any code signatures should be checked. Teams that installed extensions from the marketplace between July 26 and August 1, 2026 should check their development environments against the package names identified by Manifold Security and remove affected installations.
Open VSX has since removed the affected 77 packages from the marketplace. Further details on the specific package names, the exfiltration mechanisms used, and the identity of the attackers were not fully available at the time of reporting.
Source: thehackernews.com · Published August 5, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.