Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions
Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions is a high-severity supply chain compromise issue in Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions, an IDE extension. Affected: 77 extensions uploaded to Open VSX, upload window in July 2026.
Is Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions running on your developers' machines? Anomity finds every device with this IDE extension installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
open-vsx-removes-77-malicious-evil-twin-ide-extensions- Severity
- high
- Attack type
- Supply chain compromise, Credential theft
- Component
- Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions · IDE extension
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Manifold Security reported 77 malicious extensions uploaded to Open VSX that impersonated popular legitimate extensions, exfiltrating developer, repository and CI data. Open VSX is the registry used by VS Code-compatible editors rather than the Microsoft Marketplace, so a fleet can be fully patched on the Marketplace side and still be exposed through the editors that resolve extensions here.
Affected versions
| Affected | Fixed in |
|---|---|
77 extensions uploaded to Open VSX, upload window in July 2026 | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run 77 extensions uploaded to Open VSX, upload window in July 2026.
How do I fix it?
Inventory installed extensions by publisher, not just by display name, since an evil twin copies the name. Enforce a publisher allowlist on every VS Code-compatible editor in the fleet, and check which registry each editor is configured to resolve from.
How do I find every machine running Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions and which version, then enforce a policy on it.