Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Another wave of trojanized VS Code extensions is hunting Ethereum developers, and the marketplace's trust model keeps failing to stop it.
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
Cybersecurity researchers have identified a malicious Visual Studio Code extension called Solidity Pro that quietly installs a browser wallet and credential stealer on developer machines. Published under names like helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, the extension has since been pulled from Open VSX, but its GitHub repository reportedly remains active. It's the latest entry in a growing pattern of supply-chain attacks aimed squarely at Solidity and Ethereum developers.
A Familiar Target
Solidity developers have become a recurring target for extension-based malware over the past year. Datadog Security Labs previously documented a campaign tracked as MUT-9332, which used extensions like solaibot, among-eth, and blankebesxstnion to pose as Solidity syntax scanners and vulnerability detectors. All three were trojanized, and all three were eventually removed after Datadog's threat hunters flagged them in the VS Code Marketplace.
Obfuscation as a Business Model
What separates these campaigns from garden-variety malware is patience and disguise. Security firm StepSecurity found that the iolitelabs.solidity-macos extension combined five distinct obfuscation techniques with platform-specific payloads, delivering different code depending on whether a victim was running Apple Silicon, Intel Macs, or Windows. On Windows, it dropped a keylogger disguised as a Chrome installer; on macOS, it persisted through a spoofed Apple LaunchAgent.
"One malicious Open VSX extension reportedly stayed benign long enough to rack up more than 14,000 downloads before activating a remote access trojan the moment a victim opened a .sol file."
Impersonation, Dormant Accounts, and RATs
Checkmarx researchers traced a related incident in which a compromised or impersonated publisher account delivered a ScreenConnect-based remote access trojan to Solidity developers. The report noted a pattern of 'Juan Blanco look-alike' publishers on Open VSX — including one using an uppercase 'I' to mimic the legitimate Solidity extension author's name. Rescana separately documented a fake Solidity extension on Open VSX used to backdoor blockchain developers, urging teams to blocklist known malicious hashes and domains and audit for unauthorized ScreenConnect installations.
Why Marketplaces Keep Getting Fooled
Open VSX and the official VS Code Marketplace both allow relatively low-friction publishing, which is precisely what makes them attractive to attackers impersonating legitimate tooling authors. Once installed, these extensions run with the same privileges as the editor itself, giving them direct access to clipboard data, browser storage, and local files — including anything resembling a crypto wallet seed phrase or API key. Removal after the fact does little for developers who already installed the poisoned package before takedown.
The Solidity Pro incident is unlikely to be the last. As long as Ethereum development tooling remains a high-value target and extension marketplaces remain easy to publish to under borrowed or near-identical names, researchers expect this cat-and-mouse cycle to continue. Developers auditing their own editor extensions for unfamiliar publishers may be the most immediate defense available right now.
Editorial Note
The research corroborates the core narrative: Solidity developers face recurring supply-chain attacks via malicious VS Code extensions using obfuscation, credential theft, and remote access trojans. Specific campaigns (MUT-9332, iolitelabs, SleepyDuck) and techniques are verified across multiple sources. However, the opening claims about 'Solidity Pro' extensions (helper-beeps.solidity-pro and web3devtoolsx.solidity-pro) are not explicitly confirmed in the provided research, limiting full verification of the article's headline focus.
Claim Tracker
AI-assessed
The research provided discusses malicious Solidity extensions broadly but does not specifically mention these two extension names or confirm their payload details.
Source 3 (Datadog Security Labs) directly confirms discovery of these three extensions purporting to provide syntax scanning and vulnerability detection, all trojanized.
Source 6 (StepSecurity) confirms five obfuscation techniques and platform-specific payloads, with a Windows keylogger delivered via Chrome impersonation MSI.
Source 2 (LinkedIn post citing SleepyDuck) confirms an extension remained benign through 14,000+ downloads before activating malware upon .sol file opening.
Source 5 (Checkmarx) documents 'Juan Blanco look-alike' reports including uppercase 'I' impersonation and confirms ScreenConnect-based RAT delivery to Solidity developers.
Ask AI about this story
// discussion
sign in to join the discussion