Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Overview

Cybersecurity researchers have flagged a cluster of malicious Visual Studio Code (VS Code) extensions masquerading as Solidity smart contract development tools. The lead extension — Solidity Pro (helper-beeps.solidity-pro) — functions as a browser wallet and credential stealer, silently exfiltrating sensitive data from infected developer workstations.

This is a targeted supply chain attack directed at Web3 developers, who often work with high-value crypto wallets and access to cryptocurrency infrastructure.

The Extensions

Researchers identified at least two malicious extensions in the attack:

The extensions were published to the VS Code marketplace under names and descriptions designed to appear as legitimate Solidity development utilities — blending in with the genuine tools commonly used by Ethereum and EVM-compatible blockchain developers.

What It Steals

Once installed, the malicious extension targets:

• Browser-based crypto wallets — MetaMask, Phantom, and other browser extension wallets via local storage and extension data paths
• API keys — Scans environment files (.env, .env.local, etc.) and configuration files for embedded keys
• Stored credentials — Browser-saved passwords and authentication tokens
• Seed phrases / private keys — Any plaintext wallet recovery phrases or private keys found in local files or clipboard

The exfiltrated data is sent to attacker-controlled infrastructure, enabling immediate theft of cryptocurrency assets and unauthorized access to developer accounts and services.

Why Developers Are the Target

Web3 and blockchain developers are a high-value target for exactly this kind of supply chain attack:

1. Direct access to funds — A compromised wallet seed phrase gives attackers immediate, irreversible control of all assets in that wallet
2. Infrastructure access — API keys often control deployment infrastructure, node providers (Alchemy, Infura), or smart contract admin functions
3. Trust in development tools — Developers routinely install extensions from the marketplace with minimal scrutiny, trusting the ecosystem
4. High-value environment files — .env files in Web3 projects routinely contain private keys for contract deployment and testing

The attacker's choice of a Solidity extension is deliberate — Solidity developers are Ethereum smart contract engineers, precisely the people most likely to have significant on-chain assets and privileged infrastructure access.

How This Attack Works

1. Attacker publishes malicious extension to VS Code Marketplace
   using a name closely mimicking legitimate Solidity tooling

2. Developer installs extension, granting it access to the
   VS Code extension host (file system, environment, etc.)

3. Extension silently scans:
   - Browser extension storage (wallet seeds, private keys)
   - Project files (.env, config, keystore files)
   - Browser credential stores

4. Collected data is exfiltrated to attacker C2 infrastructure

5. Attacker drains wallets and accesses accounts immediately

How to Identify and Remove

Check Installed Extensions

Open VS Code and review installed extensions:

View → Extensions → Filter: Installed

Remove any extension matching solidity-pro, helper-beeps.solidity-pro, or web3devtoolsx.solidity-pro.

Assess Exposure

If you had either extension installed:

1. Assume wallet compromise — Transfer assets immediately to a new wallet generated on a clean device
2. Rotate all API keys — Regenerate any keys that existed in your development environment
3. Change passwords — Assume browser-stored credentials are compromised
4. Audit on-chain activity — Check all wallets for unauthorized transactions

Prevent Recurrence

• Verify publisher identity before installing any VS Code extension
• Prefer extensions from known organizations with a track record and publication history
• Never store seed phrases or private keys in plaintext files on a development workstation
• Use hardware wallets for any significant crypto holdings
• Enable VS Code extension auto-update to receive security patches for legitimate extensions

The Broader VS Code Extension Threat

This incident is part of a pattern of increasingly sophisticated supply chain attacks targeting the VS Code extension marketplace. Security researchers have documented multiple campaigns using VS Code extensions to:

• Target specific developer communities (Web3, cloud, security)
• Blend malicious packages with legitimate-sounding names
• Operate covertly for extended periods before detection

The VS Code marketplace does not perform deep behavioral analysis of extensions, and the level of access granted to extensions makes them a powerful attack surface — comparable in risk to npm package poisoning but affecting developer workstations directly rather than downstream users.

References

• The Hacker News — Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Related Reading

• Glassworm Supply Chain Attack Abuses 72 Open VSX Extensions to Target Developers
• CanisterWorm Blockchain C2 Self-Spreading npm Worm