Malicious Visual Studio Code extensions posing as “Solidity Pro” tooling have been caught delivering an information-stealing payload that targets browser-based crypto wallets, developer credentials, and API keys, underscoring ongoing supply chain risks in popular code editors.[1]
Researchers report that two packages, helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, advertised as utilities for Solidity and Web3 development, were in fact trojanized extensions distributed through the Open VSX registry.[1] Although both have since been removed from Open VSX, the GitHub repository for web3devtoolsx/solidity-pro remained accessible at the time of the research, raising concerns that the code could be cloned, repackaged, or sideloaded by unsuspecting developers.[1]
According to analysis by Yeeth Security, early releases of the Solidity Pro extensions, from versions 1.0.0 through the 2.4.x line, were observed beaconing to Cloudflare Workers endpoints to retrieve an encrypted Python payload that was then executed on the developer’s machine.[1] Later builds, starting with version 3.0.0, reportedly evolved into a full-fledged information stealer capable of harvesting browser profiles, cryptocurrency wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens from compromised systems.[1] Researchers have not associated any CVE identifier with this campaign, and no vendor advisory has been published so far, leaving defenders reliant on community disclosures.[1]
The Solidity Pro incident slots into a broader wave of malicious VS Code and Open VSX extensions targeting crypto and Web3 ecosystems, including campaigns that seeded marketplaces with dozens of wallet-draining and credential-stealing plugins masquerading as legitimate development tools.[2][5][6] Other investigations have documented VS Code extensions that hijack browser sessions, loot credentials for GitHub and Open VSX, and systematically target popular browser wallet extensions, leading in some cases to substantial cryptocurrency theft.[4][9][12] The repeated abuse of extension marketplaces highlights how quickly malicious packages can gain trust and reach among developers before they are discovered and removed.[2][5]
Any developer who installed the Solidity Pro extensions on a development workstation should assume that secrets stored in browsers, CLI tools, source-control clients, or wallet software may have been exposed, given the stealer’s broad targeting of credentials and crypto assets.[1] Beyond direct theft of funds, compromise of SSH keys, Git tokens, or CI/CD credentials can open the door to downstream source-code tampering and software supply chain attacks that extend well beyond the initial victim environment.[1][5]
Organizations are advised to immediately uninstall any suspicious Solidity-themed extensions that match the reported names, thoroughly scan affected machines, and rotate all potentially exposed credentials, tokens, and keys, including those used for wallet access and source-control platforms.[1][5] Longer term, security teams should treat IDE and editor extensions as part of their attack surface: maintain an approved extension list, monitor marketplace updates, and enforce least privilege around development tooling to reduce the blast radius when a malicious package slips through.[2][5]
References
- Solidity Pro VS Code Extensions Steal Crypto Wallets, API …
- ‘WhiteCobra’ floods VSCode market with crypto-stealing extensions
- Malicious VSCode Extensions Steal Crypto Wallets and Browser Sessions
- Malicious IoliteLabs VSCode Extensions Target Solidity …
- The obfuscation game: MUT-9332 targets Solidity …
- Malicious VS Code extensions resurface, stealing GitHub …
- VSCode market struck by huge influx of malicious WhiteCobra extensions
