Malicious Solidity Pro VS Code Extensions Steal Crypto Wallets and API Keys

Malicious Solidity Extensions Target Web3 Developers

Cybersecurity researchers from Yeeth Security have exposed a malicious campaign delivering credential and cryptocurrency stealers through rogue Microsoft Visual Studio Code (VS Code) extensions disguised as smart contract development tools. The primary malicious package, published under the identifier Solidity Pro (“solidity-pro”) and distributed via extension IDs helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, was engineered to compromise Web3 software engineers and steal sensitive secrets from local development environments.

The campaign illustrates a structured evolution in developer supply chain attacks. Early builds of Solidity Pro—spanning versions 1.0.0 through v2.4.x—acted as lightweight downloaders that beaconed to Cloudflare Workers endpoints to pull down and execute an encrypted Python payload. Starting with version 3.0.0, the threat actors upgraded the extension into a fully featured information stealer. This later iteration harvests browser profile data, cryptocurrency wallet vaults (including MetaMask, Phantom, Rabby, Coinbase Wallet, Trust Wallet, and Keplr), source-control authentication tokens, API keys, SSH keys, and Telegram bot tokens. All collected intelligence is compiled and exfiltrated directly via an attacker-controlled Telegram bot.

Although the malicious extensions are no longer available on the Open VSX registry, the associated GitHub repository (web3devtoolsx/solidity-pro) has remained accessible, posing ongoing risk for automated build systems or developers pulling code directly from source control.

Delayed Activation and Evasion Mechanics

The technical sophistication behind the Solidity Pro campaign highlights structural vulnerabilities in developer tool ecosystems. Extension marketplaces rely heavily on automated static analysis and short-duration sandbox execution during submission reviews. To bypass these security gates, the attackers implemented multi-layered obfuscation and deliberate activation delays.

The extension’s codebase splits critical strings across immediately invoked function expression (IIFE) lookup tables, reassembling them dynamically at runtime while cycling method names across successive releases. This tactic invalidates signature-based static analysis, forcing defenders to track dynamically shifting code structures. Furthermore, the malware uses intermediate clean releases to build marketplace trust and clean installation statistics before introducing malicious functionality.

Crucially, the threat actors incorporated randomized delayed activation routines that hold back malicious execution for several hours or days following installation. Automated marketplace scanners observe newly uploaded packages for only a few minutes; by the time the malicious execution path triggers on a developer workstation, automated checks have already marked the extension as benign, and the user has integrated the tool into their daily workflow.

This technique builds upon previous supply-chain tactics documented by Yeeth Security. In June 2026, researchers uncovered ethdevtools.solidity-language-support, a rogue Ethereum development tool that deployed a delayed-activation clipboard hijacker. Instead of spawning noisy subprocesses or generating outbound network connections, that malware monitored the system clipboard and silently swapped copied cryptocurrency addresses with attacker-owned wallet addresses. By leveraging the native vscode.env.clipboard.writeText API, the extension executed arbitrary clipboard modification without invoking child_process or writing to disk—completely evading security tooling focused on dangerous Node.js imports.

Broader Ecosystem Exploitation and WhiteCobra Attribution

The operational playbook behind Solidity Pro closely matches WhiteCobra, a threat cluster identified in September 2025 distributing Lumma Stealer through trojanized VS Code tools. This activity is part of a broader push targeting developer environments across open-source package repositories and editor extension stores.

Recent discoveries indicate that threat actors are simultaneously seeding malicious dependencies across npm and alternative IDE platforms:

• Targeted IDE Enumeration: The extension DigitalBarberTrim.html-entity-codec specifically inspects host environments for AI-enhanced VS Code forks, including Cursor, Windsurf, Codium, and Positron. When running on these specialized developer builds, it drops a secondary remote VSIX package, while delivering a lightweight, harmless stub on standard environments to avoid detection.
• Malicious npm Packages: An npm package named ascii-fetcher relies on a nested dependency (@jaymara/jsononifier) to decode embedded base commands (such as executing calc.exe or arbitrary payloads) via child_process.exec using the windowsHide flag.
• Script Droppers: A cluster of 10 distinct VS Code extensions was found delivering Windows-based BAT, JavaScript, and HTA droppers. Two of these packages contained npm dependencies designed with postinstall lifecycle hooks to download and launch remote payloads automatically upon package installation.

Organizational Blast Radius and Remediation

Developers represent high-value targets for enterprise network intrusion and financial theft. Because software engineers maintain elevated privileges, access to source control management (SCM) tokens, production cloud API keys, SSH keys for infrastructure management, and local crypto wallet vaults, a single compromised IDE extension can lead to organization-wide lateral movement or severe financial loss in Web3 projects.

Organizations using VS Code, Cursor, Windsurf, or related IDEs should immediately audit installed extensions and enforce strict extension governance policies. Security teams are advised to take the following actions:

• Removal and Audit: Uninstall helper-beeps.solidity-pro, web3devtoolsx.solidity-pro, ethdevtools.solidity-language-support, DigitalBarberTrim.html-entity-codec, and the ascii-fetcher npm package. Inspect historical lockfiles and extension installation logs across developer endpoints.
• Credential Revocation: Treat all SSH keys, API tokens, source control access tokens, Telegram bot keys, and crypto wallet secrets present on impacted developer workstations as compromised. Revoke and rotate these credentials immediately.
• Process and Network Telemetry: Monitor endpoints for suspicious child processes spawned by IDE instances, specifically alerting on executions of cscript, mshta, cmd, curl, and powershell. Block external communication to unverified Cloudflare Workers endpoints and Telegram bot API traffic originating from developer environments where Telegram is not authorized for operational use.