Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
- ID
- 12608
- Status
- summarized
- Published
- 10 Aug 2026, 3:38 PM
- Fetched
- 10 Aug 2026, 5:07 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 10 Aug 2026, 5:09 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
Two malicious VS Code extensions ('helper-beeps.solidity-pro' and 'web3devtoolsx.solidity-pro') were found delivering an information stealer targeting Solidity/Web3 developers. Versions 1.0.0–2.4.x beaconed to Cloudflare Workers for encrypted Python payloads; v3.0.0+ became a full stealer harvesting GitHub/GitLab tokens, AWS keys, Cloudflare tokens, OpenAI API keys, Telegram bot tokens, crypto wallet vaults, SSH keys, and 1Password MFA tokens, exfiltrating via Telegram bot upload. The malware uses obfuscation, clean intermediate versions to build trust, and randomized delayed activation hours or days after installation to evade sandbox scanning.
Why it matters
If you develop in VS Code with community extensions—especially Web3 or Solidity tooling—audit installed extensions now and revoke any GitHub, GitLab, AWS, Cloudflare, OpenAI, or Telegram bot tokens that may have been exposed. The delayed activation means a recently installed extension that seemed fine for days could still be malicious; remove anything matching 'solidity-pro' and rotate credentials proactively.
Discussion angle
The delayed-activation evasion technique is the real story for builders: your CI sandbox or manual testing in the first hour won't catch malware that sleeps for days. What practical extension-hygiene policies should a small team adopt—pinning versions, reviewing source repos, or just assuming any extension with <10k installs and access to secrets is hostile?