Solidity Pro VS Code extensions found stealing wallets and developer secrets
Security researchers have identified malicious Microsoft Visual Studio Code extensions operating under the Solidity Pro name that deliver a browser-wallet and credential stealer. The affected packages are helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Both are no longer listed on Open VSX, although the GitHub repository for web3devtoolsx/solidity-pro remained accessible when the findings were published.
Yeeth Security said early releases, from version 1.0.0 through v2.4.x, contacted Cloudflare Workers endpoints to retrieve an encrypted Python payload and execute it. Beginning with version 3.0.0, the extensions shifted to a broader information-stealing capability aimed at browser profiles, cryptocurrency wallets and developer credentials.
Credentials and wallet data targeted
The stealer can collect GitHub tokens beginning with ghp_ and github_pat_, GitLab glpat- tokens, AWS keys and session tokens, Cloudflare cfat_ tokens, OpenAI keys, Telegram bot tokens and SSH private keys. It also targets URL credentials, 1Password MFA tokens, mnemonic and seed phrases, Bitcoin WIF or xprv material, and wallet vaults associated with MetaMask, Phantom, Rabby, Coinbase, Trust and Keplr.
Captured information is exfiltrated through a Telegram bot upload. This creates a combined risk for teams using VS Code in crypto, cloud and software delivery workflows: a single extension installation can expose both wallet assets and credentials that provide access to code repositories, infrastructure and services.
Delayed activation complicates detection
Yeeth Security described a strategy intended to bypass marketplace review, static analysis and casual sandboxing. The packages use heavy obfuscation, publish intermediate clean versions to build trust and delay malicious activation for hours or days after installation. Strings are split across IIFE tables, reconstructed at runtime and paired with method names that change between releases, making static signatures less reliable.
The activity follows a wider pattern of developer-tool abuse. A recent report on smart TV proxy and curl flaw threats highlights how seemingly useful software can become a delivery path for broader operational compromise, while this campaign focuses directly on extension trust and developer secrets.
Actions for development and security teams
Organizations that installed either Solidity Pro package should remove it, inspect dependency graphs and assess whether affected workstations contained valuable credentials or wallet data. Known command-and-control domains should be blocked, and security teams should investigate activity involving cscript, mshta, cmd, curl and powershell.
The practical implication is that extension governance must cover package provenance, update history and post-installation behaviour, while exposed tokens, keys and wallet recovery material should be treated as potentially compromised and replaced through established incident-response procedures.