Malicious Solidity Pro Extensions for VS Code Steal Developers’ Wallets and Keys

Cybersecurity specialists at Yeeth Security have reported malicious Visual Studio Code extensions distributed under the name Solidity Pro. The packages in question are helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. As of publication, both have been removed from the Open VSX catalog, but the GitHub repository web3devtoolsx/solidity-pro is still available.

Evolution of the threat

Early versions (from 1.0.0 through 2.4.x) reached out to Cloudflare Workers endpoints, downloaded an encrypted Python payload and executed it. Starting with version 3.0.0, the extension turned into a full-blown infostealer. It harvests browser profiles, crypto wallets, version-control tokens, API keys, SSH keys and Telegram bot tokens, then exfiltrates the stolen data through a Telegram bot.

The list of data the attackers are after is extensive: GitHub and GitLab tokens, AWS keys and session tokens, Cloudflare tokens, OpenAI keys (including sk-ant-), mnemonic and seed phrases, wallet vaults for MetaMask, Phantom, Rabby, Coinbase, Trust and Keplr, Bitcoin private keys, SSH keys and credentials embedded in URLs.

Betting on patience

The malware’s defining trait is its ability to lull its victims. It leans on heavy obfuscation, ships interim “clean” versions to earn trust, and activates its malicious code only hours or days after installation. By that point the user already considers the extension useful, while automated scanners — which watch a package for only a couple of minutes — have long since lost interest. The obfuscation is not decorative: strings are split into pieces and reassembled at runtime, and method names change from release to release so that signature-based detection is left chasing a moving target.

In the researchers’ assessment, the scheme echoes the techniques of the WhiteCobra cluster, spotted in September 2025 distributing Lumma Stealer through VS Code extensions. This is not the first such case: in June 2026 the same company identified the extension ethdevtools.solidity-language-support, which swapped copied crypto addresses in the clipboard for the attacker’s address via the built-in vscode.env.clipboard.writeText call — with no network requests and no file writes.

Not an isolated incident

Other malicious packages were discovered in parallel: the npm module ascii-fetcher, which hid malicious code in a dependency; ten VS Code extensions carrying Windows droppers; and the extension DigitalBarberTrim.html-entity-codec, which, before deploying its payload, checked for VS Code forks such as Cursor, Windsurf, Codium and Positron, palming off an “almost empty stub” on everyone else.

Users who installed these extensions are advised to remove them, review their dependency graphs, block known C2 domains, and monitor for the execution of the commands cscript, mshta, cmd, curl and powershell.

Source: The Hacker News