Between July 26 and August 1, 2026, a cluster of 77 malicious extensions was uploaded to the Open VSX marketplace — the open-source alternative to Microsoft’s Visual Studio Marketplace used by VSCodium, Gitpod, Eclipse Theia, and other editors. Each one impersonated a legitimate developer extension by copying its real name, namespace, and description, then swapping out the extension’s bundled extension.js with data-exfiltration code. All 77 have been removed from Open VSX as of August 3. The research was published by Manifold Security.
Of the 77 extensions, 58 were lightweight reconnaissance payloads that sent the infected machine’s hostname to an attacker-controlled domain. The remaining 19 went further, transmitting the developer’s OS username, editor name and version, machine ID, platform and architecture, locale and timezone, and the full file system path of the open workspace — enough to map out a development environment in detail. Researchers noted that many of the malicious copies were published under low version numbers like 0.0.1, which can cause them to appear as a downgrade or a new namespace that hasn’t caught up to the real one yet.
How to check if you’re affected
Affected products are the 77 impersonated extensions discovered by Manifold Security. Check your editor’s installed extensions list for any of these names: amd.gaia-vscode, artsy.artsy-studio-extension-pack, configcat.configcat-feature-flags, iotaledger.iota-move, marketplace.visualstudio, obyte.oscript-vscode-plugin, openeuphoria.vscode-euphoria, oss.sfmc-devtools-vscode, rumbledb.jsoniq-vscode, ssagov.uef-snippets, taskfile.vscode-task, and others. If any extension you have installed shows a version of 0.0.1 for a tool that has been around much longer, compare the publisher account against the legitimate extension on the official marketplace. Remove and reinstall only from a verified publisher account. If you suspect your environment was compromised, rotate any API keys, tokens, or credentials stored in your workspace folders — the 19 heavier payloads transmitted workspace paths, which means attackers may know exactly where secrets are stored.