The warning captures the tactic behind a newly flagged set of malicious Visual Studio Code extensions that pose a direct threat to cryptocurrency holders, developers, and anyone who stores credentials or API keys on a development machine. Researchers identified two names in the campaign — helper-beeps.solidity-pro and web3devtoolsx.solidity-pro — and found that the extensions evolved from a lightweight loader into a broad information stealer that siphons wallets, tokens, and keys for exfiltration.
Which extensions and repositories are involved
Yeeth Security reported the two Solidity-themed VS Code extensions above; neither is currently available on Open VSX, but the GitHub repository for "web3devtoolsx/solidity-pro" remained accessible as of writing. Early releases of the extensions were tracked in versions 1.0.0 through v2.4.x, while the developers shifted behavior beginning with v3.0.0.
How the malware evolved: payload delivery and activation timing
According to the findings, the initial iterations (1.0.0–v2.4.x) beaconed to Cloudflare Workers endpoints to retrieve an encrypted Python payload which they then executed. Starting with v3.0.0, the extensions adopted a full information-stealing capability. The campaign uses several evasion techniques explicitly documented by Yeeth Security: heavy obfuscation that splits and reassembles strings at runtime, switching method names between releases, intermediate “clean” versions to build user trust, and randomized delayed activation that may wait hours or days before running malicious code. Those tactics are intended to defeat marketplace review, signature-based scanning, and brief sandbox analysis.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWhat data is being harvested and how it’s exfiltrated
Yeeth Security provides a detailed inventory of the data the stealer targets. The list includes:
- Source-control tokens: GitHub ghp_ and github_pat_ tokens, GitLab glpat- tokens
- Cloud and API keys: AWS keys and session tokens, Cloudflare cfat_ tokens, OpenAI sk-, sk-proj-, and sk-ant- keys
- Messaging and app keys: Telegram bot tokens
- Cryptocurrency secrets: mnemonic and seed phrases; MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr wallet vaults; Bitcoin WIF / xprv
- Other credentials: SSH private keys (PRIVATE KEY), URL credentials and 1Password MFA tokens
The captured data is then reportedly uploaded to an attacker-controlled Telegram bot. That choice of exfiltration channel is one of several operational details the researchers observed.
Related malicious packages and extension behaviors
Yeeth Security linked the Solidity Pro activity to a broader spate of rogue extensions and npm packages. The report notes a playbook similarity to WhiteCobra, a cluster that in September 2025 distributed Lumma Stealer through malicious VS Code extensions. Additional recent examples include:
- An npm package called "ascii-fetcher" that embeds malicious code inside a dependency named "@jaymara/jsononifier," which decodes an embedded command (observed as "calc.exe") and runs it via child_process.exec with windowsHide.
- A set of 10 VS Code extensions that deliver Windows BAT, JavaScript, and HTA droppers; two of these bundled an npm dependency that used a postinstall hook to fetch and execute a remote payload.
- A VS Code extension named "DigitalBarberTrim.html-entity-codec" that, in certain versions, drops a remote VSIX after enumerating known VS Code forks (Cursor, Windsurf, Codium, and Positron) while serving a nearly empty stub in other environments to avoid detection.
- A June 2026 case where "ethdevtools.solidity-language-support" impersonated a Solidity language-support tool yet contained a delayed-activation clipboard stealer that replaced pasted crypto addresses using the vscode.env.clipboard.writeText API.
What this means for developers, security teams, and end users
Developers who install third-party extensions should inspect dependency graphs and be wary of newly published or minimally reviewed packages that gain traction quickly; Yeeth Security highlights intermediate “clean” versions as a trust-building technique attackers use. Security teams should consider blocking known command-and-control domains and creating alerts for invocation of scripting and network utilities — Yeeth Security specifically advised alerting on cscript, mshta, cmd, curl, and powershell. End users with crypto wallets or stored API keys should remove any suspect extensions, verify exposed credentials (including mnemonic phrases and vaults listed above), and treat potentially compromised keys as immediately at risk.
The campaign underscores a dual risk: abuse of development tooling to harvest high-value secrets, and deliberate techniques to evade automated controls. Although the offending extensions were removed from Open VSX, the continued accessibility of the web3devtoolsx/solidity-pro GitHub repository as of writing raises the practical question of whether code remnants will be repackaged or otherwise reused.
For now the concrete steps Yeeth Security recommends — removing suspect extensions, inspecting dependencies, blocking known C2 domains, and alerting on dangerous scripting calls — form the immediate defense. The episode also leaves a sharper, specific question for platform maintainers and repository hosts: when malicious code is traced to a repository that remains public, what mechanisms will prevent rapid reappearance under new names? The answer will shape whether delayed-activation, obfuscated extensions remain a recurring vector for wallet and credential theft.
Original reporting: https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
