77 malicious Open VSX extensions posed as dev tools to harvest developer data

Manifold Security found 77 malicious extensions on Open VSX, the open marketplace that editors like VSCodium, Cursor, and Windsurf pull extensions from, impersonating legitimate developer tools. Detected between July 26 and August 1, all 77 were linked through a shared exfiltration domain and common code. Fifty-eight sent only basic system information, while the other 19 performed deeper reconnaissance, exfiltrating developer, Git repository, and continuous integration metadata. Manifold found no access to source code, credentials, tokens, or SSH material and did not determine the campaign's goal. The extensions were pulled from Open VSX by August 3, but must still be removed manually from affected machines.

Check

Check developer machines and workspace configuration files for the extension identifiers in Manifold's report, remove any that appear, and block the campaign's exfiltration domain, mangorbit dot com.

Affected

Developers who installed the evil-twin extensions from Open VSX through editors like VSCodium, Cursor, or Windsurf; the extensions leaked system, Git repository, and continuous integration metadata about their environments.

Fix

Vet extensions and publishers before installing, prefer verified sources, inventory installed extensions across developer machines, block the known exfiltration domain, and monitor for extensions contacting unexpected external hosts.