Open VSX惡意擴充評測：77款「雙胞胎」外掛偷資料 | Open VSX Attack Review: 77 Evil Twin Extensions Steal Data
By Kit 小克 | AI Tool Observer | 2026-08-15
🇹🇼 Open VSX惡意擴充評測：77款「雙胞胎」外掛偷資料
Open VSX惡意擴充事件本週登上資安新聞頭條：資安公司Manifold Security揪出77款偽裝成常見開發工具的「雙胞胎」外掛，從7月26日到8月1日陸續上架，專門竊取開發環境資訊，連使用Cursor、Windsurf等以Open VSX為基礎的AI編程工具的開發者也在風險範圍內。
什麼是Open VSX惡意擴充「雙胞胎」攻擊？
簡單說，就是駭客複製知名外掛的名稱、命名空間跟說明文字，換一個沒關聯的帳號重新上架，版本號通常刻意標成不起眼的0.0.1，再把裡面真正的程式碼換成回傳資料的木馬。使用者搜尋時常常分不出真假，一裝就中招。
哪些外掛被仿冒了？
- 常見格式化與檢查工具：ESLint、Prettier等linter/formatter是重災區
- 語言與框架工具：Angular、Flutter、Python、Vue相關擴充
- 生活品質類外掛：vscode-icons、WakaTime、Better Comments
- 企業命名空間：AMD、Artsy、LEGO Education、Hyperledger、Azure、Salesforce OSS都被搶註
資料被偷走多少？
其中58款只回傳基本系統資訊（如主機名稱），但另外19款動作更大，會蒐集作業系統版本、機器識別碼、編輯器資訊、Git儲存庫metadata，甚至GitHub、Azure Dev等CI/雲端開發環境的識別資料，全部傳到2026年7月15日才註冊的網域mangorbit[.]com——比第一批惡意套件上架早了11天，代表這是一場有備而來的行動。好消息是研究人員確認這些擴充沒有碰到原始碼、憑證、SSH金鑰或瀏覽器資料。
開發者該怎麼防範Open VSX惡意擴充？
Open VSX是VS Code、Cursor、Windsurf、VSCodium等一大票AI編程工具背後共用的開源外掛市集，正因為愈來愈多AI輔助開發環境仰賴它，供應鏈風險也跟著放大。建議做法：
- 安裝前檢查發布者帳號歷史、下載數與評論，而不是只看名稱
- 版本號異常低（如0.0.1）卻聲稱是知名工具，直接列入可疑
- 企業環境建議用私有extension registry或白名單機制鎖定允許安裝的擴充
- 定期稽核已安裝擴充清單，移除不再使用或來源不明的項目
常見問題
Q1：我的VS Code或Cursor中鏢了嗎？
檢查已安裝擴充清單，若有ESLint、Prettier等常見工具且版本號是0.0.1，或發布者帳號很新、沒有其他作品，建議立即移除並清除快取。
Q2：Open VSX跟微軟官方VS Code Marketplace是同一個嗎？
不是。Open VSX是Eclipse基金會維護的開源替代市集，VSCodium、Cursor、Windsurf等非微軟授權的編輯器都靠它抓外掛，審核機制相對寬鬆。
Q3：這次攻擊會不會影響我的原始碼？
Manifold Security表示這77款擴充沒有存取原始碼、憑證或SSH金鑰，主要竊取的是環境與Metadata資訊，但仍建議提高警覺並輪替相關認證。
Q4：Open VSX官方後續有什麼防範措施？
惡意擴充已於8月3日全數下架，但市集本身尚未公布長期審核機制升級計畫，開發者仍須自行把關安裝來源。
好不好用，試了才知道。
🇺🇸 Open VSX Attack Review: 77 Evil Twin Extensions Steal Data
The Open VSX malicious extensions story broke this week: security firm Manifold Security uncovered 77 evil twin extensions impersonating popular developer tools, published between July 26 and August 1, 2026. Because Open VSX also powers AI-first editors like Cursor and Windsurf, the blast radius reaches well beyond classic VS Code users.
What Are the Open VSX Evil Twin Extensions?
Attackers copied the names, namespaces, and descriptions of legitimate extensions, republished them under unrelated accounts, and tagged most with a suspiciously low version number, 0.0.1, while swapping the real code for a data-exfiltration payload.
Which Extensions Got Impersonated?
- Linters and formatters: ESLint, Prettier, and code runners were among the most-copied
- Language/framework tooling: extensions for Angular, Flutter, Python, and Vue
- Quality-of-life tools: vscode-icons, WakaTime, Better Comments
- Squatted namespaces: AMD, Artsy, LEGO Education, Hyperledger, Azure, Salesforce OSS, and even a .gov agency
How Much Data Did They Steal?
58 of the 77 extensions sent only basic system info like hostname. The other 19 went further, collecting OS details, machine identifiers, editor metadata, Git repo info, and CI/cloud identifiers from environments like GitHub and Azure Dev, all funneled to mangorbit[.]com, a domain registered just 11 days before the first malicious package went live, suggesting a planned campaign. The one bit of good news: researchers found no evidence the extensions touched source code, credentials, SSH keys, or browser data.
How to Protect Yourself From Open VSX Malicious Extensions
Open VSX is the shared open-source extension marketplace behind VS Code, Cursor, Windsurf, and VSCodium, and as more AI-assisted coding tools lean on it, supply-chain risk scales right along with adoption. Practical steps:
- Check publisher history, install counts, and reviews before installing, not just the extension name
- Treat a suspiciously low version number (like 0.0.1) on a well-known tool as a red flag
- Enterprises should lock installs to a private registry or extension allowlist
- Periodically audit installed extensions and remove anything unused or unverified
FAQ
Q1: Was I affected?
Check your installed extensions for common names (ESLint, Prettier, etc.) with version 0.0.1 or from brand-new publisher accounts, remove and clear cache immediately if found.
Q2: Is Open VSX the same as Microsoft's VS Code Marketplace?
No. Open VSX is an Eclipse Foundation-maintained open-source alternative used by non-Microsoft-licensed editors like VSCodium, Cursor, and Windsurf, with lighter vetting.
Q3: Could this expose my source code?
Manifold Security says the 77 extensions did not access source code, credentials, or SSH keys, mainly environment and metadata info, but rotating credentials is still a sane precaution.
Q4: What is Open VSX doing about it long-term?
The malicious extensions were removed by August 3, but no long-term vetting overhaul has been announced yet, developers still need to vet install sources themselves.
好不好用，試了才知道。
Sources / 資料來源
- Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data - The Hacker News
- 77 evil twin Open VSX extensions - Manifold Security (original research)
- 77 Open VSX extensions found harvesting developer info - BleepingComputer
常見問題 FAQ
我的VS Code或Cursor中鏢了嗎？
檢查已安裝擴充清單，若有ESLint、Prettier等常見工具且版本號是0.0.1，或發布者帳號很新，建議立即移除並清除快取。
Open VSX跟微軟官方VS Code Marketplace是同一個嗎？
不是。Open VSX是Eclipse基金會維護的開源替代市集，VSCodium、Cursor、Windsurf等編輯器靠它抓外掛，審核機制相對寬鬆。
這次攻擊會不會影響我的原始碼？
Manifold Security表示這77款擴充沒有存取原始碼、憑證或SSH金鑰，主要竊取環境與Metadata資訊，但仍建議提高警覺。
Open VSX官方後續有什麼防範措施？
惡意擴充已於8月3日全數下架，但市集尚未公布長期審核機制升級計畫，開發者仍須自行把關安裝來源。
延伸閱讀 / Related Articles
- AI代理欺騙評測：700起案例揭露agent竄改說謊 | AI Agent Deception Review: 700 Scheming Cases Found
- AISI資安測試評測：Mythos 5假造身分闖開源社群 | AISI Cyber Test Review: Mythos 5 Faked IDs to Hack OSS
- Hugging Face遭駭評測：OpenAI模型作弊逃出沙盒駭系統 | Hugging Face Hack Review: OpenAI's AI Cheated Its Way Out
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言