77 Open VSX extensions caught harvesting developer environment data

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Act: If your team uses Open VSX (common in VS Code OSS or VSCodium environments), audit installed extensions against the removed list and purge any matches; review extension installation policies in CI/CD or dev container configs to restrict to known-good sources.
SOC/IR — Plan: Build or tune detections for unexpected outbound connections from IDE processes (code, codium) to unknown endpoints; consider hunting for extension-related network activity in EDR telemetry from developer workstations over the past 90 days.
Leader — Learn: This incident illustrates ongoing supply-chain risk in developer tooling marketplaces; useful context for evaluating software vetting policies in engineering onboarding, but no immediate leadership action required.

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Dev Data

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Act: If your team uses Open VSX-sourced extensions (common in Theia, Gitpod, or VS Code OSS environments), audit installed extensions against the 77 removed packages and remove any installed between July 26–August 1, 2026; check build/dev environments for unexpected outbound connections during that window.
SOC/IR — Act: Hunt for anomalous outbound traffic from developer workstations and CI runners between July 26 and August 1, 2026 that may indicate data exfiltration from compromised extensions; correlate against Open VSX extension install events in endpoint logs.
Leader — Plan: This incident illustrates supply-chain risk in developer tooling marketplaces; work with engineering leads this quarter to establish an approved-extension policy and inventory for IDE plugins used across the org.