Counterfeit VS Code/Open VSX extension install squatting known vendor namespace at version 0.0.1/0.0.2

Ethan Andrews@eandrews

•updated Aug 4, 2026•5•0•6

Detects creation of a VS Code/Open VSX extension folder whose name reuses a known legitimate vendor namespace (AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, US government) but is published at an implausibly low version (0.0.1 or 0.0.2), matching the 'evil twin' extension-confusion pattern.