Malicious Solidity Pro VS Code Extensions Steal Crypto Wallets and API Keys

Yeeth Security has flagged two malicious VS Code extensions published under the name Solidity Pro: helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Both delivered a browser wallet and credential stealer. Neither is available on Open VSX any longer, though the GitHub repository for web3devtoolsx/solidity-pro remains live as of the report. Original reporting for this article comes from The Hacker News.

Solidity is the programming language used to write Ethereum smart contracts, and developers working in it install editor extensions for syntax highlighting, linting, and compiler integration. Those extensions are small, plentiful, and rarely reviewed line by line. If your team builds or audits blockchain code, an extension installed once sits inside the same editor process that touches your private keys, cloud credentials, and repository tokens.

The campaign evolved across releases. Versions 1.0.0 through 2.4.x beaconed to Cloudflare Workers endpoints, pulled down an encrypted Python payload, and executed it. Starting at v3.0.0, the extension became a full information stealer that collects browser profiles, crypto wallet vaults, source-control tokens, API keys, SSH private keys, and Telegram bot tokens, then exfiltrates the haul through a Telegram bot upload.

Yeeth Security assesses that the activity follows the same high-level playbook as WhiteCobra, the cluster identified in September 2025 for distributing Lumma Stealer through malicious VS Code extensions. That matters for scope. This is a repeatable model, not a one-off package.

The practical severity comes from what gets taken. A stolen GitHub personal access token or AWS session token gives an attacker the same access your developer has, including the ability to push code into projects your customers consume. Stolen mnemonic and seed phrases produce irreversible losses, since blockchain transfers cannot be reversed or charged back once signed.

The affected extension names are the starting point for checking what your developers have installed.

Attack Chain: From Installation to Wallet Compromise

The malicious builds moved through two distinct generations. Versions 1.0.0 through v2.4.x beaconed to Cloudflare Workers endpoints to pull down an encrypted Python payload and execute it locally, which maps to MITRE ATT&CK T1102 (Web Service) for command and control and T1059.006 for Python execution. Hosting the second stage on a Cloudflare Workers domain means the traffic blends with ordinary developer tooling calls, so egress filtering based on domain reputation alone will not flag it.

From v3.0.0 onward the operators dropped the staged loader and shipped the stealer directly inside the extension. It enumerates browser profiles, crypto wallet vaults, source-control tokens, API keys, SSH keys, and Telegram bot tokens, then uploads the collected archive through a Telegram bot. Telegram exfiltration (T1567, exfiltration over web service) uses HTTPS to a legitimate platform, so the outbound leg looks like normal chat traffic.

The harvesting logic keys on recognizable secret prefixes, which is why the loot list reads like a credential inventory of a modern engineering team:

• GitHub ghp_ and github_pat_ tokens, GitLab glpat- tokens
• AWS keys and session tokens, Cloudflare cfat_ tokens
• OpenAI sk-, sk-proj-, and sk-ant- keys
• Mnemonic and seed phrases, Bitcoin WIF and xprv material
• MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallet vaults
• SSH private keys matching PRIVATE KEY, URL-embedded credentials, and 1Password MFA tokens

A stolen personal access token lets an attacker push code, read private repositories, and pivot into CI pipelines using permissions your build system already trusts.

Evasion is built into the release cadence. The operators publish intermediate clean versions to build trust, apply randomized delayed activation so the malicious branch fires hours or days after install (T1497.003, time-based sandbox evasion), and split strings across IIFE tables that reassemble at runtime with method names rotating between releases.

"By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on," Yeeth Security said.

A separate June 2026 extension, ethdevtools.solidity-language-support, shows a quieter variant of the same idea. It ran a delayed clipboard stealer (T1115) that scraped BIP-39 seed phrases, Ethereum private keys, and wallet addresses, then substituted an attacker-controlled address when a recognized crypto address appeared on the clipboard. The swap used vscode.env.clipboard.writeText, a first-party editor API that needs no child_process, no network calls, and no file writes, so scanners hunting dangerous Node imports see nothing.

Yeeth Security places this playbook alongside WhiteCobra, the cluster identified in September 2025 pushing Lumma Stealer through malicious VS Code extensions, indicating shared tradecraft rather than a one-off actor.

Related packages fill out the picture. The npm package ascii-fetcher hid its payload in the dependency @jaymara/jsononifier, decoding an embedded command (calc.exe in the observed sample) and running it through child_process.exec with windowsHide set. Ten further extensions delivered Windows BAT, JavaScript, and HTA droppers, two of them using an npm postinstall hook to fetch and run a remote payload. DigitalBarberTrim.html-entity-codec enumerated VS Code forks including Cursor, Windsurf, Codium, and Positron before dropping a remote VSIX in select versions and serving a near-empty stub otherwise, while Zlmiles.zlmiles-liquid used a suspected builder kit to drop an MSI installer hosted on a Replit domain.

Organizations and Operational Consequences for Development Teams

The stealer's target list tells you what the loss actually looks like. It harvests mnemonic and seed phrases, MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallet vaults, plus Bitcoin WIF keys and xprv extended private keys. Anyone holding those values controls the funds, and on-chain transfers cannot be reversed or charged back, so your exposure equals whatever those wallets hold at the moment the operator decides to drain them.

The credential haul goes well past crypto. GitHub ghp_ and github_pat_ tokens, GitLab glpat- tokens, AWS access keys and session tokens, Cloudflare cfat_ tokens, OpenAI sk-, sk-proj-, and sk-ant- keys, SSH private keys, URL-embedded credentials, and 1Password MFA tokens all get collected and pushed out through a Telegram bot upload.

Each of those has a distinct business cost:

• Source-control tokens let an attacker commit to your repositories with your developer's identity, which puts your published packages, smart contracts, and CI pipelines in play for downstream users who trust your releases.
• AWS keys and session tokens allow resource creation and data access billed to your account, and session tokens work without prompting for a second factor.
• API keys for model providers generate usage charges immediately and can be resold, so the first sign is often an invoice rather than an alert.
• SSH private keys reach whatever hosts trust them, including build servers and staging infrastructure holding pre-release code.
• 1Password MFA tokens undercut the assumption that a stolen password alone is insufficient.

Timing shapes the incident response cost. The malicious branch fires on a randomized delay of several hours or days after installation, and the operators shipped intermediate clean versions to build trust before flipping to the harmful build. That means your investigation cannot rely on install date to bound the exposure window, and you will need to review every version your team pulled, not just the newest one.

For a team of Solidity developers, the practical consequence is a full credential rotation across wallets, source control, cloud, and SSH while normal delivery work stops. Seed phrases cannot be rotated in the usual sense. If a compromised wallet held client, treasury, or DAO funds, you are also handling a disclosure conversation about assets you were entrusted with, which is a different problem from an internal password reset.

Reputation risk attaches to the identity, not the machine. If your developer's GitHub token is used to slip malicious code into a project other teams depend on, your organization becomes the vector in someone else's incident report. Downstream users who ingested a tainted release will ask what you knew and when, and audits of your other repositories tend to follow.

This lands the same way on freelancers and enterprise blockchain teams, for different reasons. An independent developer usually holds production wallet keys and client repository access on one laptop with no separation between them. An enterprise team has separation, but a single engineer's stolen SSH key and cloud session token can still reach shared build infrastructure, so the blast radius grows with the size of the environment rather than shrinking.

Extensions installed by one engineer are rarely tracked as organizational assets, so most teams discover the scope of the problem during the investigation rather than before it.

Detection and Immediate Containment Steps

Remove the extension first, then treat every secret that ever touched that workstation as already in someone else's hands. Inventory what is installed on each developer machine with code --list-extensions --show-versions, and run the same check inside any editor forks your team uses, since related campaigns specifically enumerated Cursor, Windsurf, Codium, and Positron before deciding whether to drop a payload or serve a harmless stub.

Once the extension is gone, work through revocation in order of what cannot be undone. Wallet material comes first, because rotating a password does nothing when a seed phrase has been copied. Generate a new wallet on a clean device and move funds there rather than trusting the old vault.

• Revoke and reissue GitHub personal access tokens, GitLab project tokens, AWS access keys and any active session tokens, Cloudflare API tokens, and OpenAI keys used from the affected host.
• Rotate SSH private keys and remove the corresponding public keys from every server and repository that trusts them.
• Reset Telegram bot tokens, since the same channel was used for exfiltration and could be reused for access.
• Re-enroll 1Password MFA and check saved items for URL credentials that included inline usernames and passwords.

In environments Capstone manages, Adlumin flags authentication that follows credential theft, including source-control and cloud API calls arriving from infrastructure your developers have never used. That matters because a revoked token still leaves you needing proof of whether it was used before you pulled it.

Within the next day or two, look for what the extension did after installation. Alert on and hunt for cscript, mshta, cmd, curl, and powershell processes spawned by the editor, which is how the related campaigns executed BAT, JavaScript, and HTA droppers. Block the known command-and-control domains at your egress point, including the Replit-hosted infrastructure used to stage an MSI installer in a separate case.

Inspect dependency graphs on any project opened on the affected machine. The pattern to look for is a benign-looking top-level package pulling a transitive dependency with a postinstall hook that fetches and runs remote code, or that decodes an embedded command and passes it to child_process.exec with windowsHide set so no console window appears.

Then audit your git history. Review commit and push logs for anything you did not author, check for new deploy keys or webhooks, and search for committed .env files that would have handed over secrets even without the stealer. If any harvested key granted access to a protocol, a client repository, or a shared cloud account, notify those owners directly, because your revocation does not cover credentials they issued.

One more check worth doing by hand: verify the recipient address on any on-chain transaction signed from the machine. A separate malicious Solidity extension replaced clipboard contents through vscode.env.clipboard.writeText, so a paste that looked correct may not have been.

For the longer term, allowlist approved extension IDs in workspace settings and disable automatic extension updates, since this family shipped clean intermediate versions to build trust before enabling the malicious branch hours or days later. Add pre-commit hooks that reject .env files and high-entropy strings, require hardware security keys for repository administration and cloud console access, and set a fixed rotation schedule for long-lived API keys.

Preventing Future Extension-Based Supply Chain Attacks

The highest-value control here is an extension allowlist. VS Code supports restricting installs through policy, and you can pin an approved set with extensions.allowed in your workspace or user settings.json, or push the equivalent through enterprise policy so developers cannot install arbitrary marketplace packages. That single change turns extension installation from an individual decision into a reviewed one, which is where this threat class has to be stopped.

Allowlisting works because these campaigns depend on install-time trust. Yeeth Security noted that the operators shipped intermediate clean versions specifically to build reputation before the malicious branch appeared, and that randomized delayed activation held the payload for hours or days after installation. Download counts and star ratings therefore tell you almost nothing about the version you are about to receive.

Before you approve any extension, check the publisher account rather than the display name. Two separate publishers pushed identically named packages in this campaign, which is the pattern to train your team on:

• Confirm the publisher ID matches the project's official identity, not just a plausible-looking name like a "web3 dev tools" account created recently.
• Verify the linked repository actually contains the extension source and has commit history predating the marketplace listing.
• Treat a brand-new publisher with a mature-sounding package name as a typosquat until proven otherwise.
• Pin versions and require a fresh review for major version bumps, since v3.0.0 was where this family changed behavior entirely.

Extension updates deserve the same review as any other dependency change. The ascii-fetcher npm package hid its execution logic in a transitive dependency, @jaymara/jsononifier, which decoded an embedded command and ran it through child_process.exec with windowsHide set. Two of the ten rogue VS Code extensions researchers documented bundled an npm dependency that used a postinstall hook to fetch and execute a remote payload, so reviewing only the extension's own code misses the delivery path.

Static analysis alone will not carry this. A related Solidity impostor performed its clipboard swap through vscode.env.clipboard.writeText, a first-party editor API that needs no child process, no network call, and no file write. Scanners tuned to flag dangerous Node imports return clean on that code, which is why your controls need to sit at the execution and policy layers rather than only at the package-scanning layer.

For high-risk work, separate the environment from the assets. Run smart contract development in a dedicated VM or container with no wallet extensions installed, no long-lived cloud keys in the environment, and signing performed on a separate host or hardware device. If an extension does activate, it enumerates a workstation that holds nothing worth exfiltrating.

Endpoint controls cover the dropper stage. The documented families delivered BAT, JavaScript, and HTA droppers, a remote VSIX pulled in select versions, and an MSI installer hosted on a Replit domain. SentinelOne flags and blocks that post-install execution chain across managed environments, including the cscript, mshta, cmd, curl, and powershell invocations researchers recommend alerting on, which matters most on developer machines where scripting interpreters are legitimately in daily use.

Close the loop with a short briefing for your developers. Explain that WhiteCobra and the clusters copying its playbook rely on a useful-looking package earning trust first, and that a helpful extension is not evidence of a safe one. Give the team a named channel for requesting additions to the allowlist so the control does not get bypassed for convenience.

What to Do If Your Keys or Credentials Were Exposed

If a wallet vault or seed phrase ever sat on the affected workstation, move the funds before you start investigating. On-chain transfers settle permanently, so the forensic work can wait a few minutes while the balance goes somewhere the operator does not hold the key material for.

Confirm the infection on the host itself rather than from memory of what was installed. Two artifact types matter most:

• Process ancestry showing cscript, mshta, cmd, curl, or powershell spawned as a child of the editor or its extension host process, which is the pattern researchers flagged for this family of extensions.
• Outbound connections to Telegram bot API endpoints, the exfiltration channel this stealer used to upload captured data.
• Unexpected VSIX or MSI files written to disk, and npm dependency trees containing a postinstall hook that fetches and runs a remote payload.

Then check your wallet history line by line. A related campaign replaced clipboard contents with an attacker-controlled address at paste time, so a transfer that failed silently or went to an address you do not recognize is a signal even if no vault was drained.

For asset protection, generate the replacement wallet on a device that has never been connected to the suspect machine, and do it with networking off. For API keys and access tokens, revoke instead of rotating where the provider supports it, because revocation invalidates the credential immediately while a rotation can leave the old value valid during an overlap window. Kill active sessions on every service where you can, since a stolen session token keeps working after a password change.

Preserve evidence before you flatten anything. Copy the extension directory, editor logs, shell history, and browser profile files to external storage, and note the install timestamp so you can bound the exposure window. Reimaging destroys the only record of what ran and when, and without that window you cannot tell an auditor which secrets were live during the compromise. N-able Cove restores the workstation from a recovery point that predates the extension install across managed environments, which lets you rebuild without guessing at a clean baseline.

Next, follow the credentials outward. Pull cloud provider audit logs and review API calls made from unfamiliar source addresses. In your source-control organization, check for newly added deploy keys, SSH keys, OAuth app authorizations, and personal access tokens you did not create. Audit git history for commits, force-pushes, and workflow file changes in the exposure window, since a modified CI pipeline turns one stolen token into repeated code execution inside your build environment.

Reporting closes the loop. Notify every project whose repositories your tokens could reach and ask maintainers to review merges from that period. If a contract deployer key, treasury signer, or multisig participant key was on the machine, contact the project's security address and rotate signer membership rather than waiting to see whether funds move. Report the extension identifier to the marketplace security team and the package registry so it is pulled from distribution, and share the C2 domains you found with your network team for blocking.

Write down what you revoked, when, and what remained unrecoverable. That record is what your team works from if a second developer turns up with the same extension installed.

The Critical Action: Audit Your Extensions Now

The one action that matters here is comparing your installed extension list against the names researchers have published. Everything else follows from knowing whether a malicious package is present on your machine.

The confirmed names to check for:

• helper-beeps.solidity-pro
• web3devtoolsx.solidity-pro
• ethdevtools.solidity-language-support, flagged in June 2026 as a fake Solidity language-support tool
• DigitalBarberTrim.html-entity-codec
• Zlmiles.zlmiles-liquid, since removed from the VS Marketplace
• The npm package ascii-fetcher, which hides its execution path inside the dependency @jaymara/jsononifier

If your team pulls npm dependencies into the same projects, that last entry matters as much as the editor extensions. Yeeth Security also tied this activity to the same playbook as WhiteCobra, the cluster that pushed Lumma Stealer through malicious VS Code extensions in September 2025, so the technique has a working track record behind it rather than being a one-off experiment.

Two things make the check worth doing even if you believe your extensions are clean. First, the operators published intermediate versions with no malicious code, so an extension you reviewed at install time may have been benign when you looked at it. Second, some builds served a nearly empty stub to certain environments and a live payload to others, which means one developer's clean result does not clear a teammate's machine.

If you write or audit Solidity in VS Code, or in any of its forks, open your extension list and compare it against the names above.