Cybersecurity researchers at Yeeth Security have uncovered two malicious Visual Studio Code extensions — both named “solidity-pro” — that target blockchain and Web3 developers. Published under the identifiers helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, the extensions impersonate a legitimate Solidity development tool for Ethereum and other smart-contract platforms. Neither extension is now available on Open VSX, but one of the underlying GitHub repositories remains publicly accessible.
Early versions of the extensions (1.0.0 through 2.4.x) beaconed out to Cloudflare Workers endpoints to download and execute an encrypted Python payload. Starting with version 3.0.0 the malware evolved into a full information stealer that sweeps the victim’s machine for browser wallet vaults, mnemonic phrases, private keys, and a remarkably broad set of developer credentials: GitHub and GitLab tokens, AWS access keys and session tokens, Cloudflare tokens, OpenAI API keys (including sk-ant- keys for Anthropic), Telegram bot tokens, SSH private keys, and 1Password MFA tokens. The collected data is then uploaded to an attacker-controlled Telegram bot. To evade detection, the extensions use heavy string-splitting obfuscation, randomly delayed activation (the malicious code can sit dormant for hours or days after installation), and intermediate “clean” release versions designed to build trust with automated marketplace scanners and users before flipping malicious in a later update. Yeeth Security notes the technique overlaps with the WhiteCobra threat cluster, which previously delivered Lumma Stealer via malicious VS Code extensions.
How to check if you’re affected
Affected products include any installed version of the solidity-pro extension from the publishers helper-beeps or web3devtoolsx in VS Code or compatible editors. Open your VS Code extensions panel (Ctrl+Shift+X), search for “solidity-pro,” and uninstall any result from either of those publishers immediately. Because the malware uses delayed activation, removal alone may not be enough if the extension was installed for more than a day — treat any API keys, wallet seeds, or SSH keys that were present on the machine as compromised and rotate them. Any crypto wallet whose seed phrase or vault file was accessible on the affected machine should be treated as fully compromised; move funds to a freshly generated wallet before revoking API credentials.