Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

77 malicious 'evil twin' extensions were uploaded to the Open VSX marketplace between July 26 and August 1, 2026, impersonating legitimate developer tools. They were removed on August 3, 2026. The extensions reused names, namespaces, and descriptions of real Open VSX extensions but were published through unrelated accounts at low version numbers (e.g., 0.0.1). The malicious code replaced the bundled 'extension.js' file to capture and transmit data, falsely framing it as 'anonymous usage metrics.' None provided advertised functionality; instead, they displayed a status bar item before executing data exfiltration. All 77 extensions sent data to 'mangorbit[.]com', registered July 15, 2026. Two tiers of malicious behavior were identified: (1) 58 lightweight extensions exfiltrating hostname, workspace folder name, and/or editor version; (2) 19 recon-heavy extensions transmitting local hostname, OS username, editor name/version/host kind/machine ID, platform/architecture, locale/timezone, workspace folder name and full file system path, Git remote hosts and organizations, developer email domain, current branch, HEAD commit SHA hash, up to 60 installed extension IDs, proxy hostname, CI environment markers (GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite organisation slug, CircleCI project username, Codespace name, Gitpod workspace context URL), and telemetry opt-out status. The recon variant features DNS TXT record fallback for alternate exfiltration URLs if the primary domain is blocked, and a retry mechanism operating at ~15 minutes, ~50 minutes, ~3.5 hours, then every 7-8 hours, resuming on editor restart, for up to 7 days. It also detects whether the install was triggered by a repository configuration (devcontainer.json or .vscode/extensions.json) versus a manual human install. Separately, a related supply chain attack named ChainDrop compromised 450 unique npm packages (2,244 artifacts) delivering a self-propagating credential-stealing worm called 'Mini Shai-Hulud,' delivered via a heavily obfuscated Bun-based JavaScript payload executed via npm preinstall lifecycle hooks. The malware steals credentials, uses stolen npm/GitHub tokens to push trojanized package versions, and injects Claude and VS Code configuration files into repositories for persistence and developer-to-developer infection.