Open VSX Malicious Extensions: 77 Fake Tools Removed

**Executive Summary:** Researchers identified a campaign in which 77 malicious "evil twin" extensions were uploaded to the Open VSX marketplace (Jul 26–Aug 1, 2026) that impersonated legitimate developer tools, collected extensive development-environment information (hostnames, OS, workspace paths, Git metadata, CI/CD variables, installed extensions, telemetry) and exfiltrated it to mangorbit.com with DNS TXT fallback and retry persistence for up to seven days; Open VSX removed the extensions on Aug 3, 2026.