77 counterfeit Open VSX extensions harvested developer and CI metadata

Why it matters

Developer extensions run inside environments connected to private repositories and build systems. Counterfeit packages can map that infrastructure without stealing source code or credentials, defeating defenses focused only on conventional malware signatures.

Security researchers found 77 counterfeit extensions on the Open VSX Registry that copied legitimate developer tools while sending machine and development-environment data to infrastructure controlled by a single operator.

Manifold Security head of research Ax Sharma (@Ax_Sharma) and researcher Cody Nash identified the extensions between July 26th and August 1st, according to Manifold's technical report. BleepingComputer reported that Open VSX had removed the packages by August 3rd. Removal from the registry does not uninstall extensions already present on developer machines, build images or cloud workspaces.

Manifold was founded by Neal Swaelens (@NealSwaelens), Oleksandr Yaremchuk (@alex_yaremchuk) and Michael McKenna. Swaelens and Yaremchuk previously built Laiyer AI and its open-source LLM Guard toolkit, which Protect AI acquired in January 2024. Their new company is betting that security teams need to watch what AI agents and developer tools do at runtime, rather than relying on package descriptions or scans performed before installation.

The Open VSX discovery is a direct demonstration of that thesis. The counterfeit packages used readable code, avoided obvious credential theft and disclosed much of their data collection as telemetry. Their distinguishing behavior only became clear when researchers compared what the extensions claimed to do with the data they collected and the systems they contacted.

One campaign, two levels of reconnaissance

All 77 extensions reused names, namespaces and descriptions belonging to genuine Open VSX packages, while unrelated accounts published the counterfeits. Most carried version number 0.0.1. Instead of delivering the advertised functionality, the packages replaced the legitimate extension's bundled extension.js code with a beacon and displayed a status-bar indicator or message saying the extension was active.

The copied identities covered technologies and organizations including AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA and a U.S. government agency namespace. Manifold said the genuine publishers were not involved and their authentic extensions were unaffected.

Fifty-eight of the packages sent a relatively narrow set of data, typically the machine hostname and, in some variants, the workspace folder name or editor version. The remaining 19 assembled a broader profile roughly four to five seconds after activation.

Those 19 collected the operating-system username and hostname, machine identifier, editor name and version, processor architecture, locale, timezone and the full filesystem path of the open workspace. They inspected selected files under .git to identify remote hosts and organizations, the domain in the developer's configured commit email, the current branch and the HEAD commit hash.

The extensions also enumerated as many as 60 installed extensions and checked for identifiers associated with GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, GitHub Codespaces and Gitpod. On a build runner or cloud development environment, some of those variables can reveal a private repository's full name or path.

Manifold found no evidence that the packages accessed source code, credentials, authentication tokens, SSH material or browser data. The researchers did not attribute the campaign or assign a motive. The collected metadata was still sufficient to map an organization's development stack, repository structure and continuous-integration providers.

The telemetry disclosure concealed the central risk

The extension listings included a telemetry section and accurately described several collected fields. They also said source code and credentials were not accessed, which Manifold confirmed by examining the code.

The disclosure broke down around CI data. The listings said the packages detected the names of CI markers without transmitting their values. Manifold found that the code sent both, including variables that can identify private projects. The listings also omitted checks showing whether an extension had been installed through a repository's devcontainer.json or .vscode/extensions.json configuration.

That distinction would let the operator determine whether a person deliberately installed a package or whether project automation pulled it onto a machine. As editor setup increasingly moves into repository configurations, cloud workspaces and automated provisioning, a counterfeit name can spread without a developer studying a marketplace page.

Every package contacted mangorbit[.]com, a domain registered on July 15th, 11 days before the first extensions appeared. Each extension carried a separate tracking identifier. Most used pulse.mangorbit[.]com or pulse2.mangorbit[.]com, while other variants used an API host or randomized subdomains.

Some packages continued trying to transmit data for as long as seven days. They included fallback collection endpoints and could query a DNS TXT record for a replacement URL if their hardcoded servers stopped responding. Manifold said the infrastructure remained active when it published its report on August 4th.

Open VSX's identity problem

The Eclipse Foundation describes Open VSX as a community-driven, open platform for publishing and consuming VS Code extensions. It supplies extensions to software including Gitpod, VSCodium and Eclipse Theia, providing an alternative distribution channel to Microsoft's Visual Studio Marketplace.

That separation creates different ownership systems for the same extension names. A publisher that controls a namespace in Microsoft's marketplace may not control it on Open VSX. The 77 packages exploited that gap by pairing familiar names and descriptions with unrelated publisher accounts.

Eclipse said in October 2025 that it was introducing automated publication-time scanning after earlier malicious-extension incidents. A more recent Open VSX security statement of work calls for pre-publication malware checks, name-squatting detection, secret scanning, binary inspection and quarantine for packages that fail review.

The latest campaign shows the harder part of that work. These extensions did not need obfuscation, shell execution or credential-stealing code to create value for an operator. Their network behavior and mismatch with their advertised purpose supplied the strongest warning signs.

Manifold recommends searching developer systems, CI images and workspace configuration files for the extension identifiers in its report, blocking mangorbit[.]com and treating unverified-publisher warnings as a blocking condition for automated installation.

The research also gives Manifold a timely proof point for its commercial strategy. The company announced an $8 million seed round on March 18th, led by Costanoa Ventures with Cherry Ventures, Rain Capital and Modern Technical Fund. Manifold is using the capital to build runtime monitoring for AI agents and third-party developer components. The Open VSX packages illustrate why the company is focusing on behavior after installation: a plausible listing and clean static scan can still admit software designed primarily to profile the environment running it.