77 malicious Open VSX extensions mapped developer machines

The interesting thing about the 77 malicious Open VSX extensions pulled last week is what they didn't steal. No source code. No credentials. No tokens, no SSH keys, no browser data. They took inventory — hostnames, Git remotes, CI providers — and sent it home. That's not a smash-and-grab. That's someone building a target list.

What actually happened

Manifold Security found 77 extensions on Open VSX — the marketplace that VS Code forks and cloud IDEs pull from, including VSCodium, Eclipse Theia, and Gitpod — impersonating legitimate developer tools. The attacker domain was registered July 15, 2026. The extensions surfaced between July 26 and August 1. Open VSX had them removed by August 3.

The payloads split into two tiers. 58 of them phoned home with the bare minimum: machine hostname, sometimes the workspace folder name and editor version.

The other 19 did real reconnaissance. Per BleepingComputer's breakdown of the report, those variants exfiltrated OS username, hostname, machine identifier, editor details, platform architecture, locale, timezone, workspace paths, Git repository metadata — remote hosts, organization, branch, HEAD commit hash — up to 60 installed extension IDs, and CI/cloud environment identifiers covering GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, GitHub Codespaces, and Gitpod.

All 77 packages beaconed to the same domain: mangorbit[.]com. Manifold declined to speculate on the campaign's purpose. Install counts weren't disclosed.

Why a developer-tools supply chain attack matters for your business

Removal from the marketplace does nothing for a machine that already installed one. The extension stays on disk, and it stays in the workspace config files your team commits to the repo — .vscode/extensions.json, devcontainer definitions, editor settings that new hires clone on day one. That's how a pulled package survives its own takedown.

Two things to do this week, neither of which requires a security vendor. Block mangorbit[.]com at your DNS resolver — it costs nothing and covers every machine on the network. Grep your repos for the extension IDs in Manifold's report and check what's actually installed on developer laptops, including the ones running Cursor or Windsurf rather than stock VS Code. Those forks default to Open VSX; most teams have never thought about it.

Then ask the uncomfortable question. A reconnaissance campaign that maps which orgs use which CI, on which branches, from which machines, is a shopping list. The second half of that campaign hasn't run yet. Whoever bought the list knows your build pipeline before you know they exist.

If you contract out development, this is a vendor question, not an internal one. Ask who audits their editor extensions. Most shops have no answer.

Sources: BleepingComputer, Manifold Security.