GCVE-110-OSM-2026-10157

Malicious 'evil twin' Open VSX extension that impersonates a legitimate extension. Contains a lightweight beacon (Payload A) that transmits hostname, workspace folder name, and editor version to attacker-controlled infrastructure at mangorbit.com. Uses a User-Agent of 'vscode-ext-metrics/1.0' and includes DNS TXT failover mechanism. Published at version 0.0.1 to squat the namespace on Open VSX. === PAYLOAD: Lightweight Beacon (Type A) === Beacon hosts: pulse2.mangorbit.com Beacon paths: /t/<24-hex-tracking-id>, /api/v1/metrics, /api/v1/events DNS failover: TXT lookup at _beacon.<domain> User-Agent: vscode-ext-metrics/1.0 Behavior: Transmits hostname, workspace folder name, and editor version Retry interval: 15 minutes to 8 hours Persistence window: 7 days VSIX SHA-256: 8af30a4e2c57034a64e924a893de50450dd668528f2723a94f907a8a758965ea