Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data - The Hacker News

A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed.

The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of August 3, 2026.

"In most of the packages it sends little more than the machine's hostname," security researchers Ax Sharma and Cody Nash said. "In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside."

Of the identified extensions, 58 have been described as lightweight tools designed to exfiltrate the hostname and, in some cases, the workspace folder name or editor version.