77 Evil Twin Extensions on Open VSX Were Silently Stealing Developer Data

Emily Davis · 2026-08-05

If you're a developer who uses Open VSX, you might want to sit down for this one. A security research team just uncovered a pretty nasty operation that was hiding in plain sight on the marketplace. For about a week, a cluster of 77 extensions were quietly impersonating legitimate developer tools while siphoning off sensitive information from anyone who installed them. These weren't random sketchy add-ons either. They were "evil twin" extensions — carefully crafted copies of popular tools that looked totally legitimate on the surface. The whole thing is a stark reminder that even trusted marketplaces can become hunting grounds for bad actors. ### What Exactly Happened? According to Manifold Security, the malicious packages were uploaded to Open VSX between July 26 and August 1, 2026. That's a tight window, but it was long enough for the extensions to potentially reach a decent number of developers. The good news? Open VSX has since removed all 77 packages from the repository. The bad news? If you installed any extensions during that period, there's a chance your system was compromised. The extensions were designed to transmit information about the systems and development environments they were installed on. That means things like your operating system details, your project structure, and possibly even your environment variables could have been leaked. ### How Do Evil Twin Extensions Work? Here's the scary part: these extensions don't look malicious at all. They copy the name, description, and even the icon of a legitimate tool. A developer browsing the marketplace would see something familiar and think, "Oh, this is the tool I need." They'd hit install without a second thought. Once installed, the extension would run its malicious code in the background. It would collect data from the system and send it off to a remote server controlled by the attackers. The whole thing happens silently — no pop-ups, no warnings, no obvious signs that anything is wrong. ### Why This Matters for Your Workflow If you're using Open VSX for your daily development work, this should be a wake-up call. Here's why this kind of attack is particularly dangerous: - **Trust is the weapon**: Attackers exploit the trust developers place in well-known tools and marketplaces. - **Data exfiltration is silent**: You won't know your data was stolen until it's already gone. - **Development environments are goldmines**: Your code, your API keys, your internal tooling — all of it is valuable to attackers. ### What You Should Do Right Now First, don't panic. But do take action. Here are a few practical steps you can take to protect yourself: - Review the extensions you currently have installed on Open VSX. If you added anything between July 26 and August 1, 2026, check if it's still there or if it's been removed. - Rotate any API keys or tokens that might be stored in your development environment. It's better to be safe than sorry. - Keep an eye on your system logs for any unusual outbound connections. ### The Bigger Picture This incident highlights a growing trend in the software supply chain. Attackers are increasingly targeting developer tools because they know that one compromised developer machine can lead to a much bigger breach down the line. It's not just about the individual developer — it's about the companies and projects they work on. For the average developer, this means being more careful about what you install and where you install it from. Stick to official sources whenever possible. Verify the publisher of an extension before you install it. And if something seems off, trust your gut and do a quick search before you click that install button. ### Final Thoughts Open VSX did the right thing by removing these extensions quickly. But the reality is, this kind of attack is only going to become more common. The best defense is awareness. Stay informed, stay cautious, and don't let convenience override your security instincts. Your development environment is one of your most valuable assets. Treat it that way.