GCVE-110-OSM-2026-10220

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 26, 2026

Malicious 'evil twin' Open VSX extension that impersonates a legitimate extension. Contains a lightweight beacon (Payload A) that transmits hostname, workspace folder name, and editor version to attacker-controlled infrastructure at mangorbit.com. Uses a User-Agent of 'vscode-ext-metrics/1.0' and includes DNS TXT failover mechanism. Published at version 0.0.1 to squat the namespace on Open VSX. === PAYLOAD: Lightweight Beacon (Type A) === Beacon hosts: d9j3drkeib4sa01kk82014tt97wxnndam.cb.mangorbit.com Beacon paths: /t/<24-hex-tracking-id>, /api/v1/metrics, /api/v1/events DNS failover: TXT lookup at _beacon.<domain> User-Agent: vscode-ext-metrics/1.0 Behavior: Transmits hostname, workspace folder name, and editor version Retry interval: 15 minutes to 8 hours Persistence window: 7 days VSIX SHA-256: b8cd87d5e36f167f51ed6a6d2e824f76dc1b3792de9c10091e46f87ad07f5d5a

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	lego-education.ev3-micropython	0.0.2 (affected)	—

References

Malicious openvsx package: lego-education.ev3-micropython

advisory

vendor

Browse GCVE Records

69,368 records in the GCVE database · Updated August 24, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON