Counterfeit extensions impersonating real developer tools have been found on the Open VSX registry, with roughly a quarter of them harvesting the git and continuous integration identity of the organizations running them.
New research Manifold Security published on August 4 showed 77 packages appeared between July 26 and August 1, each republishing the name and namespace of a real extension from an account that did not own it. All beaconed to a single domain registered 11 days before the first package surfaced.
Most sent little more than a hostname. Squatted namespaces across the set included AMD, LEGO Education, Hyperledger, Azure, Artsy, Salesforce OSS, a US federal agency and marketplace.visualstudio, which impersonated the marketplace itself.
Read more on extension name abuse: Malicious VS Code Extensions Exploit Name Reuse Loophole
The Disclosure Was the Disguise
The other 19 carried a fuller payload. Seconds after activation it sent the hostname, operating system username, editor details and machine ID. It then read the repository open in the editor, taking the git remote host and organization, the commit email domain, the branch and the HEAD commit.
It also collected continuous integration values including the GitHub repository name, GitLab project path and Codespace name.
“On a build runner or a cloud development environment, that is the full private repository name, not just the organization,” Manifold explained.
The unusual part is that the listings said so. Each carried a “Telemetry” section enumerating most of those fields accurately, alongside assurances that no source code, credentials or tokens were taken. Manifold checked those claims against the code and they held.
One did not. The listing stated that continuous integration data covered marker names only and never values, while the code sent both. The single most sensitive field in the payload was the one the disclosure said was not being sent.
The extensions had no other function. A status bar item rendered a checkmark, one command displayed a message box and the beacon fired.
Built to Outlive the Takedown
The collector domain was registered through a registrar that redacts registrant details, on a three-year term. The code treated any HTTP response as success, including an error, and retried across seven days, resuming on every editor restart.
If every endpoint failed, the beacon queried a DNS TXT record for a replacement collector address, letting the operator relocate infrastructure without shipping new packages.
The payload also reported whether the workspace’s own devcontainer or extensions configuration had pulled the extension in, distinguishing installs a repository caused from installs a human chose.
Manifold argued that matters because name resolution is increasingly automated, with agents and provisioning scripts installing by name across two registries whose separate ownership rules make a squatted name indistinguishable from the real one.
Open VSX removed the packages on August 3, though the infrastructure remained live at the time of writing.
Manifold advised pinning by publisher and version where registries are mirrored internally, treating the unverified-publisher banner as a blocking condition in automated installs and alerting on editor processes contacting recently registered domains shortly after startup.
