Solidity Pro VS Code Extensions Steal Wallets and API Keys

Security researchers have traced two Solidity Pro extensions to an evolving malware family that moved from a delayed Python dropper to direct theft of cryptocurrency wallets, API keys, SSH keys, and browser credentials. The affected extension IDs are helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, with related impostor IDs also reported. Anyone who installed one should treat the workstation as exposed even if the extension looked harmless or remained quiet for several days.

The important detail is that uninstalling the extension is only the first containment step. Some versions launched code outside the editor process, while later releases searched local files and browser profiles for secrets and sent collected data through Telegram. Recovery therefore has to cover the computer, developer accounts, cloud credentials, and cryptocurrency wallets—not only VS Code.

Which Solidity Pro extensions are affected?

Yeeth Security linked the same malicious chassis to multiple publishers and more than twenty observed versions. The display name alone is not a reliable identifier, so check the full publisher and extension ID in VS Code, Cursor, Windsurf, or another Open VSX-compatible editor.

Open VSX no longer returns a latest installable package through its API for the two main IDs, but a takedown does not remove an already installed copy. Automatic updates also mean that remembering a “clean” version is not enough to rule out exposure.

How the extension avoided a quick malware check

Early builds waited between roughly 12 and 72 hours before contacting attacker-controlled infrastructure. They also checked for CI and sandbox-related environment variables, which could keep the malicious branch quiet during a short automated review. The response from the remote server was AES-GCM encrypted, written as a temporary Python file, and launched as a detached child process.

Later releases changed strategy. Instead of relying only on a downloaded payload, they searched for developer secrets already present on the workstation. The target list included GitHub and GitLab tokens, AWS and Cloudflare credentials, AI-provider API keys, Telegram bot tokens, seed phrases, browser wallet vaults, Bitcoin private-key material, SSH private keys, saved browser credentials, and some multifactor-authentication artifacts.

This evolution matters for triage. A developer who saw no immediate pop-up, antivirus alert, or suspicious editor window cannot assume the extension was dormant. A delayed execution path and decoy releases were part of the evasion model.

What to do if you installed Solidity Pro

1. Isolate the workstation. Disconnect it from production VPNs, cloud consoles, repositories, and wallet activity. Do not begin secret rotation from the possibly compromised computer.
2. Record the exact extension inventory. In VS Code, review the Extensions panel and the full publisher ID; administrators can also capture the output of code --list-extensions --show-versions. Check every VS Code-compatible editor and remote development profile used by the same account.
3. Preserve useful evidence. Save the extension ID and version, install path, timestamps, recent editor logs, unexpected Python processes, and network alerts before removing files. Teams may need this evidence to determine which credentials were reachable.
4. Remove the listed extensions and untrusted publisher packages. Do not keep a decoy version because it appears clean. Review other extensions installed from the same publisher or repository at the same time.
5. Replace exposed secrets from a clean device. Revoke source-control tokens, rotate cloud and AI API keys, replace SSH key pairs, invalidate browser and developer sessions, and review audit logs. If a wallet seed phrase or private key could have been read, create a new wallet with a new seed on a trusted device and move assets; changing an account password does not revoke a blockchain private key.
6. Scan for the payload outside the editor. Removing the extension does not remove a detached Python stage, a secondary stealer, or persistence it may have created. Run a full security scan and review startup items, scheduled tasks, services, browser changes, and suspicious files in temporary and profile directories.
7. Rebuild high-value systems when evidence is incomplete. If the machine held signing keys, deployment access, production secrets, or valuable wallets, a clean reimage is safer than assuming every payload component was found.

For a Windows workstation where the extension ran, use Gridinsoft Anti-Malware to check for infostealers, downloaded payloads, startup entries, and other persistence after the extension is removed. A scan can find local malware remnants, but it cannot invalidate stolen tokens or recover a compromised wallet seed; those steps still require account-side revocation and clean-device replacement.

How to reduce malicious extension risk

• Verify the complete publisher ID and project ownership, not only the display name, logo, rating, or download count.
• Use an organization allowlist and review extension updates before they reach workstations with production access.
• Keep hot wallets and seed phrases away from general-purpose development profiles and clipboard workflows.
• Separate build, signing, and production credentials so one editor extension cannot reach every environment.
• Audit extensions after staff, role, or project changes and remove tools that are no longer needed.

This campaign follows the same developer-tooling trust failure seen when a poisoned VS Code extension exposed GitHub repositories. The credential response also overlaps with the Keyv npm worm recovery sequence and the need to control stolen AI API keys. The practical rule is consistent: treat an extension installation or update as code execution inside the developer’s trust boundary.

References

1. Yeeth Security. “Solidity Pro’s WhiteCobra Chassis: Cloudflare C2 to Telegram Infostealer.” Yeeth Security, August 6, 2026. Technical report.
2. Koi Security. “WhiteCobra’s Playbook Exposed.” Koi Security, September 2025; accessed August 10, 2026. Campaign analysis.