Cybersecurity researchers have identified a malicious VS Code extension called Solidity Pro that exfiltrates browser wallets, API keys, and user credentials. Although removed from Open VSX, the code remains accessible on GitHub.

Key Takeaways

  • Solidity Pro VS Code extension contains malicious code
  • Steals browser wallets, API keys, and login credentials
  • GitHub repository still public, removed from Open VSX

Introduction

Security analysts have flagged two malicious VS Code extensions – helper-beeps.solidity-pro and web3devtoolsx.solidity-pro – distributed under the name Solidity Pro. These extensions covertly harvest crypto wallet addresses, API tokens, and other sensitive credentials from unsuspecting developers.

Historical Background

Microsoft Visual Studio Code, launched in 2015, quickly became the de‑facto IDE for developers worldwide. While thousands of legitimate extensions enrich its ecosystem, malicious actors have repeatedly exploited the platform’s openness, especially as blockchain development surged.

Details

The embedded scripts in these extensions silently capture wallet addresses, private keys, and API tokens from the user’s browser, then transmit the data to remote servers. Researchers observed network calls that bypass typical security prompts, enabling attackers to harvest high‑value assets without alerting the victim.

Why This Matters

BozokMedia analysis shows that compromising a developer’s IDE can give attackers a direct pipeline to high‑value crypto assets, amplifying the financial impact of supply‑chain attacks across the blockchain ecosystem.

"Once an extension gains system‑level access, it can siphon every crypto‑related credential without any user‑visible indication," warns cybersecurity expert Dr. Anshu Kumar.
Did You Know?: In 2022, over 30% of VS Code extensions were removed within a year due to discovered security flaws.

Frequently Asked Questions

Q1: Is the extension still downloadable?
A: It has been removed from the Open VSX marketplace, but the GitHub repository remains publicly accessible.

Q2: How can affected devices be secured?
A: Immediately uninstall all suspicious VS Code extensions, rotate wallet passwords, and enable two‑factor authentication wherever possible.