Counterfeit Extensions Discovered on Open VSX Registry: A New Security Threat
A recent investigation has unveiled the alarming presence of counterfeit extensions that falsely impersonate legitimate developer tools on the Open VSX registry. This has raised significant concerns as approximately 25% of these fraudulent extensions reportedly harvest sensitive Git and continuous integration identities belonging to the organizations that operate them.
According to a research report published by Manifold Security on August 4, the threat was identified between July 26 and August 1, during which 77 suspicious packages emerged. These packages not only replicated the names and namespaces of authentic extensions but were also linked to accounts that had no rights to them. The investigation revealed that all these extensions communicated with a single domain, which had been registered just 11 days prior to the first appearance of the malicious packages.
The types of organizations that had their identities impersonated are quite varied and include prominent names such as AMD, LEGO Education, Hyperledger, Azure, and Artsy, among others. Even federal agencies and the Visual Studio Marketplace were not spared, with some extensions mimicking the marketplace itself, further complicating the situation for developers who rely on these tools.
The Disguise of Disclosure
Out of the 77 packages, 19 extensions exhibited more malicious behavior. As soon as these extensions were activated, they began transmitting extensive information including the hostname, operating system username, editor details, and machine ID. They were programmed to scrutinize the repository currently open within the editor, capturing critical information, such as the Git remote host, the organization associated with the repository, the email domain tied to commits, as well as branch names and HEAD commit details.
Moreover, these extensions harvested continuous integration data, which encompassed the complete name of the GitHub repository and the path of the GitLab project. As Manifold Security explained, within a cloud development environment, this data can potentially reveal not just the organization but the full name of the private repository involved.
Interestingly, the listings for these extensions explicitly outlined the data they were collecting in a "Telemetry" section—offering assurances that they did not capture any source code, credentials, or tokens. Manifold Security verified these claims against the code and found that they held true for all extensions, except for one. This particular extension falsely claimed that it only gathered marker names for continuous integration data, but the code showed that it was also transmitting sensitive values, including the most critical information in the payload.
Notably, these malicious extensions had no functional capabilities beyond relaying this sensitive information. They merely inserted a status bar item that displayed a checkmark, included a command that showed a message box, and activated the beacon.
Infrastructure Built for Longevity
The domain that collected the stolen information was registered with a service that obscured the registrant’s details, extending over a three-year term. The clever design of the code enabled it to treat any HTTP response as a successful transmission, including error messages. This approach allowed the malicious extensions to retry the information relay over a span of seven days and to restart the process upon every launch of the code editor.
Moreover, in scenarios where all endpoints failed, the beacon would attempt to query a DNS TXT record for alternate collector addresses. This feature would facilitate the operator’s ability to relocate their infrastructure without needing to publish new package updates, showcasing a sophisticated level of planning and forethought behind these counterfeit extensions.
Additionally, the malicious payload reported whether the installation of the extension originated from the workspace’s own development container or from a manual choice, making it easier to distinguish automated installs from human-installed tools. This nuanced capability is particularly significant, given that automated name resolution is becoming increasingly mainstream, with agents and provisioning scripts bringing in packages by name from registries whose ownership rules can blur the lines between genuine and counterfeit extensions.
On August 3, Open VSX acted swiftly to remove the fraudulent packages. However, the infrastructure used by these extensions remained operational at the time of the report’s release.
In response to this troubling situation, Manifold Security has recommended that organizations take proactive steps such as pinning extensions by both publisher and version within their internal registries. They advise treating any alerts from the unverified publisher banner as critical when it comes to automated installations, and also recommend ramping up monitoring for editor processes that connect to recently registered domains shortly after startup.
This incident underscores the necessity for enhanced vigilance in safeguarding against counterfeit tools in the ever-evolving landscape of software development.