77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data

Between July 26 and Aug 1 attackers published 77 counterfeit Open VSX extensions impersonating legitimate VS Code Marketplace tools; most used version 0.0.1 and all communicated with mangorbit.com, while 19 of them collected detailed OS usernames, workspace paths, Git organization/branch info, installed extension IDs, and CI identifiers. Extensions were removed from Open VSX by Aug 3, but installed copies or images and workspace references can persist; teams should inventory extensions, inspect traffic to mangorbit.com, review provisioning images and configs, and enforce publisher allowlists and monitoring.