Two malicious VS Code extensions targeting Solidity developers have been stealing cryptocurrency wallets, API keys, and user credentials. Researchers identified the extensions as "helper-beeps.solidity-pro" and "web3devtoolsx.solidity-pro," both marketed as tools for blockchain development on the Microsoft Visual Studio Code platform.
The extensions functioned as browser wallet stealers, capturing sensitive authentication data and cryptocurrency assets from infected developer machines. The threat actors deliberately targeted the Solidity development community, exploiting the ecosystem's lack of awareness around extension security.
Both extensions have since been removed from the Open VSX registry, the open-source alternative to Microsoft's official VS Code marketplace. However, the incident underscores a persistent vulnerability in how development tools distribute software. Developers who installed either extension during their availability face direct risk of wallet compromise and credential theft.
The attack pattern reflects a broader trend of threat actors targeting developer toolchains. Extensions occupy a uniquely privileged position within development environments, granting access to local file systems, environment variables, and browser data. This makes them high-value targets for attackers seeking to compromise cryptocurrency holdings or steal API keys used in production systems.
Organizations employing Solidity developers should audit their development environments for these extensions immediately. Any developer who installed "solidity-pro" variants should rotate all cryptocurrency wallet passphrases, regenerate API keys, and review authentication logs for unauthorized access.
The incident highlights the need for stricter vetting of extension submissions across platforms. Developers should verify extension publishers through official channels, check recent review history, and remain cautious of tools offering security-adjacent functionality, which attackers frequently use as cover for malicious code.