77 counterfeit Open VSX extensions harvested developer and CI metadata
Manifold Security tied the packages to one domain; 19 profiled Git repositories and build environments before Open VSX removed them.
By Ryan Merket · Published
Primary source: BleepingComputer
Why it matters
Developer extensions run inside environments connected to private repositories and build systems. Counterfeit packages can map that infrastructure without stealing source code or credentials, defeating defenses focused only on conventional malware signatures.
Security researchers found 77 counterfeit extensions on the Open VSX Registry that copied legitimate developer tools while sending machine and development-environment data to infrastructure controlled by a single operator.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.