Over a five-day period from August 16 through August 20, the registry unblocked AlDuncanson.react-hooks-snippets , magne-sjaastad.opm-flow-editor-support , and rumbledb.jsoniq-vscode . All three IDs had been used by impostors in the 77-extension evil-twin campaign documented by Manifold Security earlier this month. Legitimate versions of the OPM and RumbleDB extensions are now live.