Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Open VSX marketplace removed 77 malicious extensions that impersonated legitimate developer tools to exfiltrate data about developers' systems and environments. The 'evil twin' extensions were uploaded between July 26 and August 1, 2026, and have since been removed following discovery by Manifold Security.

A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have been removed from Open VSX as of

Originally published at thehackernews.com

#Cybersecurity #Data-Exfiltration #Developer-Tools #Malicious-Extensions #Malware #Supply-Chain-Security #Vulnerabilities

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Talk to an architect about applying this to your stack.

More from the journal

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself

Angola's Largest Telco Breached Hours Before IPO