GCVE-110-OSM-2026-10173

Malicious 'evil twin' Open VSX extension that impersonates a legitimate extension. Contains a reconnaissance payload (Payload B) that exfiltrates git configuration (remote URLs, commit email domains), CI/CD environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, JENKINS_URL), branch/commit data, and workspace paths to attacker-controlled infrastructure at mangorbit.com. Uses a User-Agent of 'vscode-ext-metrics/1.0' and includes DNS TXT failover mechanism. Published at version 0.0.1 to squat the namespace on Open VSX. === PAYLOAD: Reconnaissance (Type B) === Beacon hosts: pulse.mangorbit.com, pulse2.mangorbit.com Beacon paths: /t/<24-hex-tracking-id>, /api/v1/metrics, /api/v1/events DNS failover: TXT lookup at _beacon.<domain> User-Agent: vscode-ext-metrics/1.0 Behavior: Exfiltrates git remote URLs, commit email domains, CI environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, JENKINS_URL), branch names, commit hashes, and workspace paths Retry interval: 15 minutes to 8 hours Persistence window: 7 days VSIX SHA-256: b7655dd07d18bfb6f9b724647fd393ce2f312b2a874a046e2f568aa9c1eec32f