Ethical Hacking News
A recent attack on the Open VSX marketplace has exposed developer data to malicious actors through a massive software supply chain vulnerability. 77 extensions were found to impersonate legitimate tools while transmitting system information, highlighting the risks of software supply chain attacks and emphasizing the need for robust security measures to protect sensitive data.
The Open VSX marketplace was targeted by a massive software supply chain attack, compromising sensitive data from unsuspecting developers. A cluster of 77 malicious extensions were discovered impersonating legitimate developer tools, transmitting information about systems and development environments. The malicious activity was uncovered by security researchers Manifold Security, who noted that the extensions had been uploaded to the repository between July 26 and August 1, 2026. The extensions transmitted data exfiltration domain and similarities in code and behavior suggest a link between the variants. Nineteen instances of the malicious extension were found to transmit detailed descriptions of machines, including repository open in the editor and CI system running inside. The malicious campaign used fake names and descriptions of real Open VSX extensions, highlighting the risks associated with software supply chain attacks. The attack is codenamed "ChainDrop" and involves delivering an information stealer malware that leverages stolen npm token to push trojanized versions containing the same malware. Security experts emphasize the need for granular permission control over package permissions, particularly when it comes to exfiltrating sensitive data.
The software supply chain has long been recognized as a potential vulnerability, particularly in the rapidly evolving landscape of open-source tools and libraries. Recently, an alarming incident highlights the potential for malicious actors to exploit these vulnerabilities, compromising sensitive data from unsuspecting developers. The Open VSX marketplace, once hailed as a trusted platform for developer tools, has been found to be the site of a massive software supply chain attack.
According to recent reports, a cluster of 77 extensions on the Open VSX marketplace was discovered to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. This malicious activity was uncovered by security researchers Manifold Security, who noted that these "evil twin" extensions had been uploaded to the repository between July 26 and August 1, 2026.
In most of the packages, these malicious extensions sent little more than the machine's hostname, however, in nineteen instances, they transmitted a detailed description of the machine, including the repository open in the editor, and the CI system the editor was running inside. This data exfiltration domain and similarities in code and behavior between both variants suggest that they are linked to each other.
The 19 extensions with names like amd.gaia-vscode, artsy.artsy-studio-extension-pack, configcat.configcat-feature-flags, iotaledger.iota-move, marketplace.visualstudio, obyte.oscript-vscode-plugin, openeuphoria.vscode-euphoria, oss.sfmc-devtools-vscode, rumbledb.jsoniq-vscode, ssagov.uef-snippets, taskfile.vscode-task, doi.fileheadercomment, mengsiCode.vscode-django-boilerplate, move.move-analyzer, uavcan.dsdl, vs-publisher-988541.apexsql-power-tools, casualjim.gotemplate, jcamp.dotnet-test-provider-view, superposition.supertoml-analyzer were all part of the malicious campaign.
The main change in these extensions involved swapping the contents of the bundled "extension.js" file with capabilities to capture and transmit data. While they displayed a status bar item along with a message that stated they are active, before firing the data exfiltration step. In all 77 extensions, the data was sent to a single domain - mangorbit[.]com.
Furthermore, further analysis indicates that these malicious extensions also carried out several other steps, including inspecting files in the workspace's .git directory to obtain Git remote hosts and organizations, enumerating up to 60 installed extension IDs, picking up the proxy hostname from the environment, reading the editor's own telemetry opt-out setting, checks if it's enabled, sending the status, querying a DNS TXT record to retrieve a fallback exfiltration URL in the event the primary domain is blocked or taken down, and triggering a retry mechanism that resumed on every editor restart.
The malicious code also featured contingency plans for cases where attempts come at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours. The recon variant also distinguished installs that a repository's configuration caused from installs by humans.
This campaign is notable because it reuses the names, namespaces, and descriptions of real Open VSX extensions but publishes them through unrelated accounts and assigns a low version number (e.g., 0.0.1). This highlights the risks associated with software supply chain attacks and demonstrates how malicious actors can exploit vulnerabilities in this area.
According to Microsoft, the campaign is codenamed "ChainDrop," which involves delivering an information stealer malware that leverages stolen npm token to push trojanized versions containing the same malware. It was discovered that the malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes. This malware was able to use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating a developer-to-developer infection path.
The trade craft of this attack bears resemblance to past Shai-Hulud npm worm activity. However, the attack remains unattributed at this stage.
Security experts emphasize the need for granular permission control over what packages can and cannot do, particularly when it comes to exfiltrating sensitive data such as AWS keys and GitHub credentials in a single command.
The incident serves as a stark reminder of the importance of vigilance in software supply chain security. As open-source tools continue to evolve at an unprecedented rate, it is crucial that developers, organizations, and industry leaders work together to address these vulnerabilities and protect sensitive data from falling into the wrong hands.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Massive-Software-Supply-Chain-Attack-Open-VSX-Marketplace-Exposes-Developer-Data-to-Malicious-Actors-ehn.shtml
https://thehackernews.com/2026/08/open-vsx-removes-77-malicious-evil-twin.html
Published: Wed Aug 5 06:23:09 2026 by llama3.2 3B Q4_K_M
