Seventy-seven extensions on the Open VSX marketplace copied the names, namespaces and descriptions of real VS Code projects, republished them at version 0.0.1 from accounts that owned neither, and then quietly took inventory of every machine that installed them. Manifold Security identified the set between 26 July and 1 August and published its findings on 4 August.
The 77 counterfeit extensions and what each tier collected. Diagram by IntelFusions.
The impersonated namespaces were not obscure ones. They included AMD, Artsy, LEGO Education, Hyperledger, Azure, IOTA and Salesforce OSS, a United States federal agency namespace, and, with some cheek, marketplace.visualstudio itself.
Fifty-eight beacons and nineteen surveyors
The set splits cleanly in two. Fifty-eight were tiny, between 1.6 and 3.3 KB, and sent little more than a hostname, sometimes an editor version or workspace folder name, and a per-package tracking identifier. The other nineteen ran to about 10 KB and did real reconnaissance, firing four to five seconds after activation.
That second tier collected the operating system username, the editor name, version, host kind and machine ID, plus platform, architecture, locale and timezone. It read the workspace folder name and its full filesystem path, the git remote URLs for origin and upstream reduced to host and organization, the commit email domain, the current branch and the HEAD commit SHA. It listed up to 60 installed extension IDs, the proxy hostname, and continuous-integration markers with their values, including the GitHub repository, the CI project path, the Azure DevOps URI, the Buildkite organization slug, the CircleCI username, the Codespace name and the Gitpod context.
The list of what they skipped
Here is the part worth sitting with. The extensions did not take source code. They did not take credentials, tokens or SSH material. They did not touch browser data or arbitrary environment variables, and they read no working-tree files at all, only .git/config and .git/HEAD. An extension has the run of the machine at that point, so this was a choice, not a limitation.
What that profile builds is a map: which organizations run which repositories, on what CI, behind what proxy, with which people. That is targeting material rather than loot. It is the reconnaissance step that usually precedes a supply-chain compromise instead of the compromise itself, and it fits the shift researchers have described toward poisoning open source packages instead of breaking into vendors.
A beacon that waits you out
Traffic went to mangorbit[.]com, registered on 15 July 2026 and paid up through 2029, mainly through pulse[.]mangorbit[.]com and pulse2[.]mangorbit[.]com, with api[.]mangorbit[.]com and randomized subdomains under cb[.]mangorbit[.]com as alternates. Requests carried the user agent vscode-ext-metrics/1.0. If DNS failed, the code looked up a TXT record at _beacon on the domain to find a fresh endpoint. The reconnaissance variant retried at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on every editor restart and giving up only after seven days.
Pulled from the store, still resolving
Open VSX removed the extensions by 3 August. The infrastructure behind them stayed operational. Anyone who installed one before that date may have kept beaconing for a week afterward, and the per-package tracking identifiers mean those check-ins tie back to specific installs. Search your fleet for connections to mangorbit[.]com and for the vscode-ext-metrics/1.0 user agent, then enumerate installed extensions and flag anything sitting at version 0.0.1 under a publisher that is not the project's own. Manifold's write-up carries the full VSIX hash set.
The npm ecosystem has spent this month absorbing worms that steal cloud keys outright, which can make a campaign that carefully takes nothing feel almost polite. It should not. Someone now holds a directory of who builds what, where, and on which pipeline, and that directory outlives every extension that was pulled to build it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.