Between 26 July and 1 August 2026, security researchers at Manifold Security found 77 "evil twin" extensions published on Open VSX, the open marketplace used by VS Code-compatible editors that don't run Microsoft's own extension store — think Cursor, Windsurf, Gitpod and other Eclipse Theia-based tools. Each fake extension reused the exact name, namespace and description of a real one from AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA and a U.S. government agency, but was published from an unrelated account carrying an artificially low version number like 0.0.1 — a trick designed to look like an early or alternate build of something a developer already trusted. Fifty-eight of the fakes quietly collected a machine's hostname and open workspace folder name, framing the behaviour internally as "anonymous usage metrics." The other 19 went further, pulling the operating system username, machine ID, editor version, locale and timezone, full workspace file paths, Git repository details, and environment identifiers from CI/CD systems including GitHub Actions, GitLab, Azure DevOps, CircleCI, Buildkite and GitHub Codespaces — plus a list of up to 60 other extensions installed on the same machine. All 77 phoned home to a single domain, mangorbit.com, which the attacker had quietly registered eleven days before the first fake package went live. Open VSX pulled the listings by 3 August; researchers found no evidence the extensions touched source code or credentials directly, but the reconnaissance data they gathered is exactly what an attacker would use to plan a more targeted follow-up.
What this means for your business
If your developers or agency use a VS Code-compatible editor that isn't stock Visual Studio Code — Cursor, Windsurf, Gitpod and similar tools pull extensions from Open VSX by default — this week's action is simple: have whoever manages your dev machines check the installed extension list against Manifold's published list of the 77 affected extension IDs, remove anything unrecognised, and block outbound traffic to mangorbit.com as a precaution. The bigger habit worth building is checking who actually published an extension, not just what it's called: a familiar name from an unfamiliar or brand-new publisher account is the exact pattern this campaign relied on, and it works just as well against a five-person team as it does against a large enterprise. If you outsource development, it's a fair question to ask your provider whether they restrict which extension marketplaces their engineers install from on client-facing machines.