Solidity Pro: malicious VS Code extension targeting Web3 developers

Researchers from Yeeth Security discovered the malicious Solidity Pro extension for Microsoft Visual Studio Code which, while masquerading as a tool for Solidity smart contract developers, steals cryptocurrency wallets, access tokens for cloud services, SSH keys and credentials from browsers. The extension was distributed under the identifiers helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Developers who installed either of these extensions must immediately remove them, rotate all potentially compromised secrets and check their systems for signs of compromise.

Evolution of the malicious code: from loader to full‑featured stealer

According to the researchers, the malicious activity evolved in stages. Early versions of the extension — from 1.0.0 to 2.4.x — contacted Cloudflare Workers endpoints to download and execute an encrypted Python payload. Starting with version 3.0.0, the extension evolved into a full‑featured infostealer with an expanded list of targets.

As reported, the stealer collects the following categories of data:

• Version control system tokens: GitHub (ghp_, github_pat_), GitLab (glpat-)
• Cloud credentials: AWS keys and session tokens, Cloudflare tokens (cfat_)
• API keys: OpenAI (sk-, sk-proj-, sk-ant-)
• Cryptocurrency wallets: MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr vaults
• Cryptographic secrets: mnemonic and seed phrases, Bitcoin WIF/xprv
• SSH keys, Telegram bot tokens, credentials from URLs and 1Password MFA tokens

The collected data, according to the researchers, is exfiltrated by uploading it to a Telegram bot. The web3devtoolsx/solidity-pro repository on GitHub remained publicly accessible at the time the research was published.

Detection evasion techniques

The multi‑layered detection evasion system used by the extension’s authors deserves particular attention. According to Yeeth Security, three key techniques are employed:

• Heavy obfuscation: strings are split across IIFE (Immediately Invoked Function Expression) tables and reconstructed only at runtime. Method names change between releases, making signature‑based detection ineffective.
• Intermediary “clean” versions: benign versions are published between malicious updates to build trust with users and marketplace review systems.
• Randomized delayed activation: the malicious code is triggered several hours or days after installation. By the time it activates, automated scanners that monitor the package only for a few minutes have already completed their checks.

Links to other malicious campaigns

Yeeth Security researchers note that Solidity Pro’s activity shares tactical patterns with the WhiteCobra threat cluster, which was observed in September 2025 distributing the Lumma Stealer via malicious VS Code extensions. It should be emphasized that this link is based on the assessment of a single research source and has not been independently confirmed.

Solidity Pro is far from an isolated case. In June 2026, the same research group identified the extension ethdevtools.solidity-language-support, which impersonated a Solidity language support tool for Ethereum developers. This extension contained a clipboard stealer with delayed activation: when a cryptocurrency address was detected in the clipboard, it was replaced with the attacker’s address via the legitimate vscode.env.clipboard.writeText API. The use of a standard API means that static scanners that only check for imports of dangerous Node.js modules do not detect such substitution.

In parallel, other malicious components in the VS Code and npm ecosystem were also discovered:

• The npm package ascii-fetcher with a malicious dependency @jaymara/jsononifier that runs embedded commands via child_process.exec
• A set of 10 VS Code extensions delivering droppers based on BAT, JavaScript and HTA
• The extension DigitalBarberTrim.html-entity-codec, which installs a remote VSIX file after enumerating VS Code forks (Cursor, Windsurf, Codium, Positron)

Impact assessment

The primary risk group is Web3 and blockchain project developers who actively use Solidity and work with cryptocurrency wallets. However, the scope of the stolen data goes far beyond the cryptocurrency domain: compromise of AWS keys, SSH keys, GitHub and GitLab tokens can lead to unauthorized access to cloud infrastructure, source code repositories and CI/CD pipelines. Theft of OpenAI keys creates a risk of financial loss due to unauthorized use of paid APIs.

The absence of official notifications from Microsoft or Open VSX about these extensions means the scale of distribution and the number of affected users remain unknown.

Practical recommendations

1. Immediate removal: uninstall the helper-beeps.solidity-pro and web3devtoolsx.solidity-pro extensions, and check for the presence of other mentioned malicious extensions.
2. Secret rotation: replace all GitHub, GitLab, AWS, Cloudflare, OpenAI and Telegram tokens that may have been accessible on the compromised machine. Generate new SSH keys.
3. Checking crypto wallets: if MetaMask, Phantom, Rabby, Coinbase, Trust or Keplr were used on the machine, treat mnemonic phrases and private keys as compromised. Transfer funds to new wallets created on a known‑clean device.
4. Process monitoring: configure alerts for the execution of cscript, mshta, cmd, curl and powershell from the VS Code context.
5. Dependency audit: examine the dependency graph of installed extensions and npm packages. Pay attention to postinstall hooks in dependencies.
6. Extension installation policy: restrict the list of allowed VS Code extensions in corporate environments. Use allowlists of approved extensions instead of unrestricted installation.

The Solidity Pro campaign demonstrates a mature attack model against the software supply chain via IDE extensions: gradual escalation of malicious functionality, evasion of automated marketplace checks and targeted collection of high‑value developer secrets. Organizations whose developers work with VS Code and its forks should audit installed extensions, enforce policies restricting installation from unvetted sources and rotate all secrets on machines where suspicious extensions are found.