{
  "entry": {
    "kind": "vuln",
    "slug": "open-vsx-removes-77-malicious-evil-twin-ide-extensions",
    "name": "open-vsx-removes-77-malicious-evil-twin-ide-extensions",
    "vendor": "Open VSX Removes 77 Malicious \"Evil Twin\" IDE Extensions",
    "description": "Manifold Security reported 77 malicious extensions uploaded to Open VSX that impersonated popular legitimate extensions, exfiltrating developer, repository and CI data. Open VSX is the registry used by VS Code-compatible editors rather than the Microsoft Marketplace, so a fleet can be fully patched on the Marketplace side and still be exposed through the editors that resolve extensions here.",
    "website": "https://www.manifold.security/blog/open-vsx-evil-twin-extensions",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ide-extension",
    "updatedAt": "2026-08-04",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "open-vsx-removes-77-malicious-evil-twin-ide-extensions",
      "aliases": [
        "ti-067"
      ],
      "title": "Open VSX Removes 77 Malicious \"Evil Twin\" IDE Extensions",
      "summary": "Manifold Security reported 77 malicious extensions uploaded to Open VSX that impersonated popular legitimate extensions, exfiltrating developer, repository and CI data. Open VSX is the registry used by VS Code-compatible editors rather than the Microsoft Marketplace, so a fleet can be fully patched on the Marketplace side and still be exposed through the editors that resolve extensions here.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "ide-extension",
      "component": {
        "name": "Open VSX Removes 77 Malicious \"Evil Twin\" IDE Extensions",
        "vendor": null,
        "package": null,
        "ecosystem": "vscode",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "77 extensions uploaded to Open VSX, upload window in July 2026",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-04",
      "modifiedAt": "2026-08-04",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.manifold.security/blog/open-vsx-evil-twin-extensions"
        }
      ],
      "mitigation": "Inventory installed extensions by publisher, not just by display name, since an evil twin copies the name. Enforce a publisher allowlist on every VS Code-compatible editor in the fleet, and check which registry each editor is configured to resolve from.",
      "detectedByAnomity": true
    }
  }
}