Open VSX惡意擴充套件事件：77款山寨外掛竊取開發者資料 | Open VSX Evil Twin Extensions: 77 Fake Add-ons Steal Dev Data

8月 11, 2026

By Kit 小克 | AI Tool Observer | 2026-08-12

🇹🇼 Open VSX惡意擴充套件事件：77款山寨外掛竊取開發者資料

Open VSX爆惡意擴充套件事件，AI編程工具用戶中鏢

Open VSX惡意擴充套件事件在8月初被資安研究人員抓包，總共揪出77款「李鬼版」擴充套件，冒充AMD、Azure、Salesforce、Hyperledger、LEGO Education、IOTA甚至美國政府機關的官方外掛名稱與敘述，偷偷把開發者的主機資訊、程式碼倉庫細節傳回攻擊者的伺服器。這起事件特別值得注意，是因為Open VSX不只是冷門備用商店——它是Cursor、Windsurf、Google Project IDX等眾多AI編程工具的預設擴充套件來源，因為這些工具基於VS Code開源版打造，沒有授權使用微軟官方Marketplace，只能改用Open VSX。

惡意擴充套件怎麼運作的？

根據資安公司披露的細節，這批Open VSX惡意擴充套件在7月26日到8月1日之間陸續上架，版本號幾乎都停在0.0.1，是典型的「新帳號、假冒名稱、複製描述」套路。77款裡有58款屬於輕量款，只回傳主機名稱，有時附上工作區資料夾名稱或編輯器版本；另外19款則更兇，會蒐集完整的機器描述、當下開啟的程式碼倉庫，以及正在運行的CI系統資訊。所有資料最終都送往mangorbit[.]com，而這個網域早在7月15日就已註冊完成，比第一款惡意擴充套件上架足足早了11天，顯示這是有計畫的行動，不是隨手測試。Open VSX團隊已在8月3日將全部77款下架。

用AI編程工具的人該怎麼自保

裝擴充套件前先查發布者：官方帳號通常有穩定的更新紀錄與下載量，版本號卡在0.0.1的新帳號要提高警覺
能用微軟官方Marketplace就別用替代商店：如果你的AI編程工具允許切換來源，優先選官方管道
盤點現有擴充套件：Cursor、Windsurf、Trae等工具的使用者可以檢查已安裝清單，移除來源不明或很久沒更新的套件
留意CI環境的outbound流量：對開發團隊來說，CI runner連到陌生網域是明顯的紅旗

這次Open VSX惡意擴充套件事件再次證明，AI編程工具帶來的效率提升，同時也把攻擊面拉大了——你信任的不只是模型，還有整條擴充套件供應鏈。好不好用，試了才知道。

🇺🇸 Open VSX Evil Twin Extensions: 77 Fake Add-ons Steal Dev Data

Open VSX Malicious Extensions: 77 "Evil Twin" Add-ons Caught Stealing Data

A wave of Open VSX malicious extensions was uncovered in early August 2026, when researchers identified 77 "evil twin" packages impersonating trusted brands like AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and even a U.S. government agency namespace. The extensions quietly exfiltrated developer machine data back to an attacker-controlled server. This matters beyond the usual supply-chain scare because Open VSX isn't a niche fallback store — it's the default extension source for AI-native coding tools like Cursor, Windsurf, and Google's Project IDX, all of which fork VS Code but can't legally use Microsoft's official Marketplace.

How the Campaign Worked

The malicious Open VSX extensions were uploaded between July 26 and August 1, 2026, published from unrelated new accounts with version numbers stuck at 0.0.1 — a classic red flag for copy-paste impersonation. Of the 77 packages, 58 were lightweight: they exfiltrated just the hostname, and sometimes the workspace folder name or editor version. The remaining 19 were far more aggressive, harvesting a detailed machine profile, the repository open in the editor, and information about the CI system the extension was running inside. All 77 phoned home to mangorbit[.]com, a domain registered on July 15, 2026 — eleven days before the first fake extension went live, suggesting a planned campaign rather than opportunistic testing. Open VSX pulled all 77 extensions by August 3.

How to Protect Yourself

Check the publisher before installing — legitimate extensions have update history and real download counts; a brand-new account shipping version 0.0.1 is a warning sign
Prefer the official Microsoft Marketplace when your editor supports switching sources
Audit what's already installed — Cursor, Windsurf, and Trae users should review their extension list and remove anything unfamiliar or stale
Watch CI outbound traffic — a CI runner reaching out to an unfamiliar domain is an easy detection signal for teams

The Open VSX incident is a reminder that the productivity boost from AI coding tools comes with a wider attack surface — you're trusting not just the model, but the entire extension supply chain behind it. 好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士