A malicious Microsoft Visual Studio Code extension known as Solidity Pro has been identified by cybersecurity researchers to be delivering a browser wallet and credential stealer. The malicious VS Code extension targeted developers in the Web3 and blockchain space.
The names of the malicious VS Code extensions are:
- helper-beeps.solidity-pro
- web3devtoolsx.solidity-pro
Neither extension is now available on Open VSX. The repository “web3devtoolsx/solidity-pro” on GitHub remains accessible as of the time this was written. The malware Solidity Pro VS Code extension poses a serious threat to developers involved with cryptocurrency and blockchain technologies.
Let me walk through the Solidity Pro VS Code extension malware, what it steals, and how it evades detection.
The Evolution of the Malicious Extensions
Malware for the Solidity Pro VS Code extension went through an evolution process. Early iterations from versions 1.0.0 through 2.4.x were found to beacon to Cloudflare Workers endpoints to retrieve an encrypted Python payload and execute it.
Subsequent versions starting with v3.0.0 shifted to a full-blown information stealer. The Solidity Pro VS Code extension malware is able to collect browser profiles, cryptocurrency wallets, source control tokens, API keys, SSH keys, and Telegram bot tokens. Exfiltration occurs by uploading the captured data using the Telegram bot.
What the Stealer Harvests
Solidity Pro VS Code extension malware collects various types of sensitive data:
- GitHub ghp_ and github_pat_ tokens
- GitLab glpat- tokens
- AWS keys and session tokens
- Cloudflare cfat_ tokens
- OpenAI sk-, sk-proj-, and sk-ant- keys
- Telegram bot tokens
- Mnemonic and seed phrases
- MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallet vaults
- Bitcoin WIF and xprv keys
- SSH private keys
- URL credentials and 1Password MFA tokens
This massive theft of information is what makes the Solidity Pro VS Code extension malware especially threatening. The developer using this extension will have their source code repository, cloud resources, and cryptocurrency wallet compromised.
Evasion Techniques
The Solidity Pro VS Code extension malware employs multiple evasion techniques to bypass marketplace review, static scanning, and casual sandboxing.
Heavy obfuscation is the first line of defense. The malware splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases. Signature-based detection must track a moving target.
Intermediate clean versions build trust with users. The malware authors release versions with no malicious code to establish a reputation before introducing the payload.
Randomized delayed activation causes the malicious code to run several hours or days after installation. By the time the malicious branch runs, the user has already decided the extension is useful. Automated scanners that only observe the package for minutes have moved on.
The WhiteCobra Connection
The Solidity Pro VS Code extension malware shares the same high-level playbook as WhiteCobra, another threat cluster detected in September 2025. WhiteCobra distributed Lumma Stealer through malicious VS Code extensions.
This technique similarity implies that the malware found in the Solidity Pro VS Code extension may have been developed by the same threat actors or even a a copycat using similar methods.
Previous Solidity Extension Attacks
The Solidity Pro VS Code extension malware is not the first time threat actors have published bogus Solidity extensions across open-source ecosystems. In June 2026, Yeeth Security flagged another extension named "ethdevtools.solidity-language-support" that impersonated a Solidity language-support tool for Ethereum developers.
That extension harbored a delayed-activation clipboard stealer to scrape BIP-39 seed phrases, Ethereum private keys, and wallet addresses. When a recognized crypto address was on the clipboard, it replaced the pasted value with an attacker-controlled address.
The swap happened through vscode.env.clipboard.writeText, a first-party API call that required no child_process, no network access, and no file writes. Static scanners that only look for dangerous Node imports would not see it.
Other Rogue VS Code Extensions
The Solidity Pro VS Code extension malware findings coincide with the discovery of other rogue VS Code extensions and npm packages.
An npm package called "ascii-fetcher" embeds malicious code in a dependency named "@jaymara/jsononifier." It decodes an embedded command and runs it via child_process.exec.
A set of 10 VS Code extensions deliver a wide range of Windows-based BAT, JavaScript, and HTA droppers. Two of them bundle an npm dependency that uses a postinstall hook to fetch and execute a remote payload.
A VS Code extension named "DigitalBarberTrim.html-entity-codec" drops a remote VSIX file in select versions after enumerating known VS Code forks like Cursor, Windsurf, Codium, and Positron. In other versions, it serves a nearly empty stub to fly under the radar.
What Developers Should Do
Users who have installed the Solidity Pro VS Code extension malware or similar extensions should take immediate action.
First, remove the extensions from VS Code and any other editors where they may be installed. Second, check dependency graphs for any suspicious package.Third, block the domains associated with command-and-control. Fourth, monitor for usage of cscript, mshta, cmd, curl, and powershell.
Apart from these urgent steps, developers need to change any credentials that were potentially exposed. If the Chrome extension has been used, then GitHub tokens, AWS keys, and crypto wallet seeds can be assumed compromised.
The Detection Challenge
The Solidity Pro VS Code extension malware demonstrates the detection challenge facing the VS Code ecosystem. The marketplace review process for extensions cannot detect all malicious extensions.
The limitation of automated scanning tools includes the detection of delayed execution and hidden code. It is up to the users to pay attention to what extensions they are installing and the permissions they grant.
Another instance that points out the dangers of Web3 is the Solidity Pro VS Code extension malware. The reason why attackers target crypto developers is that they possess valuable assets.
Wrapping It Up
The Solidity Pro VS Code extension malware is a malicious extension that delivers credential and wallet stealers to developers. Early versions beamed to Cloudflare Workers, while later versions became full-featured information stealers.
The malware harvests tokens from GitHub, AWS keys, cryptocurrency wallets, SSH keys, and Telegram bots. It escapes detection via obfuscation, use of clean intermediate files, and delayed execution.
The Solidity Pro VS Code extension malware shares techniques with the WhiteCobra cluster. Similar attacks have been observed with other Solidity extensions and rogue VS Code packages.
It is advised that developers should uninstall the extensions, examine their environments, and rotate any exposed credentials. The VS Code ecosystem needs proper vetting of extensions before installing them.
FAQ Section
What is the Solidity Pro VS Code extension malware?
It is a malicious VS Code extension that delivers credential and wallet stealers. This malware harvests GitHub tokens, AWS keys, cryptocurrency wallet vaults, SSH keys, and Telegram bot tokens.
What extensions are malicious?
Helper-beeps.solidity-pro and web3devtoolsx.solidity-pro extensions are malicious. These extensions are not available for download from Open VSX any more, but you can still access their GitHub page.
How does the malware avoid detection?
The malware makes use of numerous obfuscation methods, clean intermediary copies for creating trust and random time delays before executing. The malware runs its payload hours or days after the installation process has taken place.
What kind of information does the stealer collect?
This stealer will extract GitHub tokens, GitLab tokens, AWS keys, Cloudflare tokens, OpenAI keys, Telegram bot tokens, mnemonics, wallet vaults, SSH keys, and 1Password MFA tokens.
What should the developers do?
Developers have to un-install extensions, analyze dependency graphs, prevent C2 domain access, monitor commands, and change credentials.
