TLDR Tech / InfoSec
77 Open VSX extensions found harvesting developer info
Manifold Security uncovered an "evil twin" campaign on the Open VSX registry involving 77 malicious extensions that impersonated legitimate packages to harvest developer environment data. While claiming to only collect anonymous metrics, the most aggressive variants actively exfiltrated OS usernames, workspace paths, Git commit hashes, and CI/CD infrastructure details to mangorbit[.]com, utilizing DNS TXT lookups for C2 resilience. Although Open VSX removed the packages on August 3, security teams should block the C2 domain and manually audit developer environments for the malicious extension IDs.
Read the full story