Skip to content
CertGPS

Open VSX Extension Malware Campaign

77 Open VSX extensions were found to be harvesting developer information, impersonating legitimate developer tools, and transmitting system and development environment metadata to an attacker's server.

Severity awaiting reviewSupply chain
Incident date
Published
Read time
5 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

View source
On this page

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

In July 2026, a high-severity supply-chain attack targeted Open VSX extensions, affecting multiple companies, including AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and a U.S. government agency. The attack, known as the "Open VSX Extension Malware Campaign," lasted approximately 7 days and impacted 77 devices. The attackers created 77 Open VSX extensions that impersonated legitimate developer tools, harvesting developer information and transmitting it to a server at mangorbit[.]com.

The attack's impact was significant, with the affected companies potentially exposing sensitive information about their systems and development environments. The incident highlights the importance of securing supply chains and verifying the authenticity of software components.

What Happened: Timeline

✅ Verified Facts

  • July 15, 2026: mangorbit[.]com was registered.
  • July 26, 2026: Manifold Security detected the extensions.
  • August 1, 2026: Manifold Security finished detecting the extensions.
  • August 4, 2026: The article was published.

Technical Deep Dive

Understanding Open VSX

What is it? Open VSX is an open-source extension framework for Visual Studio Code (VS Code), a popular code editor developed by Microsoft. Open VSX allows developers to create and distribute extensions that can enhance the functionality of VS Code.

How does it work? Open VSX extensions are built using the VS Code API and are distributed through the Open VSX registry. When a user installs an Open VSX extension, the extension is loaded into the VS Code environment, where it can interact with the user's code and development environment.

Security considerations The Open VSX framework relies on the trustworthiness of the extensions and their developers. If an extension is compromised, it can potentially expose sensitive information about the user's system and development environment.

Visual Studio Code (VS Code) is a popular code editor developed by Microsoft. VS Code is built using the Electron framework and provides a wide range of features, including syntax highlighting, code completion, and debugging.

Electron is a framework for building cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. Electron allows developers to create desktop applications that can run on multiple platforms, including Windows, macOS, and Linux.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the attack appears to be the compromise of the Open VSX extension framework. The attackers created 77 Open VSX extensions that impersonated legitimate developer tools, harvesting developer information and transmitting it to a server at mangorbit[.]com.

Contributing Factors

The contributing factors to the attack include:

  • The lack of proper security measures in place to verify the authenticity of Open VSX extensions.
  • The use of compromised developer credentials to create and distribute malicious extensions.
  • The failure of the affected companies to detect and respond to the attack in a timely manner.

Lessons for Security Professionals

Key Takeaways

  1. Verify the authenticity of software components: Security professionals should ensure that all software components, including Open VSX extensions, are verified for authenticity before installation.
  2. Implement proper security measures: Security professionals should implement proper security measures, such as code signing and digital certificates, to prevent the installation of malicious software components.
  3. Monitor for suspicious activity: Security professionals should monitor for suspicious activity, such as unusual network traffic or system behavior, to detect and respond to attacks in a timely manner.

Prevention & Detection

How to Prevent

  • Verify the authenticity of Open VSX extensions: Security professionals should verify the authenticity of Open VSX extensions before installation.
  • Implement code signing and digital certificates: Security professionals should implement code signing and digital certificates to prevent the installation of malicious software components.
  • Monitor for suspicious activity: Security professionals should monitor for suspicious activity, such as unusual network traffic or system behavior, to detect and respond to attacks in a timely manner.

How to Detect

  • Monitor network traffic: Security professionals should monitor network traffic for suspicious activity, such as unusual connections to mangorbit[.]com.
  • Monitor system behavior: Security professionals should monitor system behavior for suspicious activity, such as unusual system calls or process creation.
  • Use security tools: Security professionals should use security tools, such as intrusion detection systems and security information and event management (SIEM) systems, to detect and respond to attacks in a timely manner.
View related certification topics

Security+

  • Domain 1: Security and Risk Management
  • Domain 2: Asset Security
  • Domain 3: Security Assessment and Testing
  • Domain 4: Security and Risk Management

CEH

  • Domain 1: Network Security
  • Domain 2: Vulnerability Assessment
  • Domain 3: Malware Analysis
  • Domain 4: Web Application Security

CISSP

  • Domain 1: Security and Risk Management
  • Domain 2: Asset Security
  • Domain 3: Security Engineering
  • Domain 4: Software Development Security

OSCP

  • Domain 1: Penetration Testing
  • Domain 2: Vulnerability Assessment
  • Domain 3: Malware Analysis
  • Domain 4: Web Application Security

CISM

  • Domain 1: Information Security Governance
  • Domain 2: Information Risk Management
  • Domain 3: Information Security Program Management
  • Domain 4: Information Security Incident Management

CISM

  • Domain 1: Information Security Governance
  • Domain 2: Information Risk Management
  • Domain 3: Information Security Program Management
  • Domain 4: Information Security Incident Management

CySA+

  • Domain 1: Security and Risk Management
  • Domain 2: Asset Security
  • Domain 3: Security Operations and Monitoring
  • Domain 4: Incident Response

PenTest+

  • Domain 1: Penetration Testing
  • Domain 2: Vulnerability Assessment
  • Domain 3: Malware Analysis
  • Domain 4: Web Application Security

Source (1)

This analysis is based on: https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.