Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

1. Executive summary

Two malicious VS Code extensions — helper-beeps.solidity-pro and web3devtoolsx.solidity-pro — have been identified as delivering a full-spectrum information stealer targeting browser profiles, cryptocurrency wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The extensions evolved from early versions (1.0.0–2.4.x) that beaconed to Cloudflare Workers for encrypted Python payloads into v3.0.0+, which implements direct exfiltration via Telegram bot uploads. The GitHub repository for web3devtoolsx/solidity-pro remains accessible as of reporting. EMEA financial services with development teams building on Solidity or Web3 tooling are at direct risk of source-code credential compromise and hot-wallet theft.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While credential theft from developer workstations could escalate into an ICT-related incident, the trigger here is a supply-chain compromise of a developer tool — no article in the provided regulatory reference specifically addresses development-environment integrity or IDE extension security in a way that changes client obligations beyond generic incident management.

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access: Developer installs helper-beeps.solidity-pro or web3devtoolsx.solidity-pro from Open VSX or clones the GitHub repository web3devtoolsx/solidity-pro.
2. Trust-building phase: Extension ships intermediate clean versions to build marketplace trust and pass static review. No malicious behaviour is exhibited during initial installation.
3. Delayed activation: Malicious code triggers several hours or days after installation — by design, to evade sandbox analysis that observes packages for only minutes.
4. Payload execution (v1.0.0–v2.4.x): Extension beacons to Cloudflare Workers endpoints to retrieve an encrypted Python payload and execute it locally.
5. Payload execution (v3.0.0+): Extension runs a full information stealer directly. Obfuscation splits strings across IIFE (Immediately Invoked Function Expression) tables, reassembles them at runtime, and rotates method names between releases to defeat signature-based detection.
6. Data harvesting: Stealer collects: - GitHub ghp_ and github_pat_ tokens - GitLab glpat- tokens - AWS keys and session tokens - Cloudflare cfat_ tokens - OpenAI sk-, sk-proj-, and sk-ant- keys - Telegram bot tokens - Mnemonic and seed phrases - MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr wallet vaults - Bitcoin WIF / xprv keys - SSH private keys (PRIVATE KEY) - URL credentials and 1Password MFA tokens
7. Exfiltration: Captured data is uploaded via a Telegram bot — using the bot API as a C2/exfil channel, which blends with legitimate Telegram traffic.

Additional context from the same reporting (single-sourced to Yeeth Security via The Hacker News)

• The activity shares the same high-level playbook as WhiteCobra, a threat cluster detected in September 2025 distributing Lumma Stealer through malicious VS Code extensions. Attribution to WhiteCobra is unconfirmed — no MITRE profile is available in the verified reference data, and the link is based on playbook similarity only.
• A related extension, ethdevtools.solidity-language-support, was flagged in June 2026 as a delayed-activation clipboard stealer targeting BIP-39 seed phrases, Ethereum private keys, and wallet addresses. It uses vscode.env.clipboard.writeText — a first-party VS Code API — to swap clipboard contents with attacker-controlled addresses. This requires no child_process, no network access, and no file writes, making it invisible to static scanners focused on dangerous Node imports.
• An npm package ascii-fetcher embeds malicious code in a dependency @jaymara/jsononifier that decodes an embedded command (observed: calc.exe) and executes it via child_process.exec with windowsHide.
• A set of 10 additional VS Code extensions deliver Windows-based BAT, JavaScript, and HTA droppers, with two bundling an npm dependency using a postinstall hook to fetch and execute a remote payload.
• DigitalBarberTrim.html-entity-codec enumerates known VS Code forks (Cursor, Windsurf, Codium, Positron), drops a remote VSIX file in select versions, and serves a "nearly empty stub" in others to evade detection.

Confidence caveat: All technical detail above is single-sourced to Yeeth Security as reported by The Hacker News. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Search all developer workstations and CI/CD build agents for the following installed VS Code extensions and remove immediately:
• helper-beeps.solidity-pro
• web3devtoolsx.solidity-pro
• ethdevtools.solidity-language-support
• DigitalBarberTrim.html-entity-codec
• Check for the GitHub repository web3devtoolsx/solidity-pro in any cloned repos or developer GitHub stars/lists.
• Identify any workstations that have installed these extensions in the past 90 days. Treat as compromised — assume all listed credential types have been exfiltrated.
• Force rotation of ALL credentials that may have been present on affected workstations:
• GitHub personal access tokens (ghp_, github_pat_)
• GitLab tokens (glpat-)
• AWS keys and session tokens
• Cloudflare tokens (cfat_)
• OpenAI API keys (sk-, sk-proj-, sk-ant-)
• Telegram bot tokens
• SSH private keys
• 1Password MFA tokens
• Revoke and recreate all cryptocurrency wallet vaults (MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr) and rotate any exposed seed phrases/mnemonics. Move any assets from potentially compromised wallets to new addresses.
• Block outbound traffic to Telegram Bot API endpoints (api.telegram.org) from developer workstations where feasible, or monitor for anomalous Telegram API usage.

P2 — Within 72 hours

• Audit all VS Code extensions installed across the organisation. Remove any extensions not on an approved allowlist.
• Search npm dependencies for ascii-fetcher and @jaymara/jsononifier across all repositories and build environments. Remove and audit for child_process.exec with windowsHide usage.
• Review CI/CD pipeline logs for any postinstall hook execution fetching remote payloads.
• Inspect developer workstations for VS Code forks (Cursor, Windsurf, Codium, Positron) and audit extensions installed in those environments.
• Deploy EDR monitoring for:
• VS Code extension host processes spawning child_process or Python interpreters
• Network connections from VS Code or Node.js processes to Cloudflare Workers endpoints
• File reads of browser profile directories and SSH key directories by VS Code processes

P3 — Within 7 days

• Implement an extension allowlist policy for VS Code and all forks (Cursor, Windsurf, Codium, Positron) across the organisation.
• Establish a process for reviewing VS Code extension source code before allowlisting, with specific attention to delayed activation patterns, IIFE-based string obfuscation, and vscode.env.clipboard API usage.
• Review DORA Art. 24 (digital operational resilience testing — general requirements) obligations in the context of developer tooling supply-chain security — this item demonstrates that development environments are an active attack surface requiring resilience testing.
• Brief development teams on the threat landscape: malicious Solidity/Web3 extensions, clipboard-stealing techniques via first-party APIs, and npm postinstall hook abuse.

5. Indicators of compromise

No atomic network indicators (IPs, domains, URLs) or file hashes are provided in the source material. The Cloudflare Workers endpoints and Telegram bot tokens used for C2/exfiltration are not specified.

Behavioural indicators

extension  helper-beeps.solidity-pro
extension  web3devtoolsx.solidity-pro
extension  ethdevtools.solidity-language-support
extension  DigitalBarberTrim.html-entity-codec
npm_package  ascii-fetcher
npm_package  @jaymara/jsononifier
github_repo  web3devtoolsx/solidity-pro

6. Detection

rule Solidity_Pro_VSCode_Stealer {
  meta:
    author = "Adverse Trace"
    date = "2026-08-10"
    reference = "https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html"
    description = "Detects obfuscated string reassembly and credential harvesting patterns in Solidity Pro malicious VS Code extensions"

  strings:
    $ext_name_1 = "solidity-pro" nocase
    $ext_name_2 = "helper-beeps" nocase
    $ext_name_3 = "web3devtoolsx" nocase
    $token_ghp = "ghp_"
    $token_github_pat = "github_pat_"
    $token_gitlab = "glpat-"
    $token_cf = "cfat_"
    $token_openai_1 = "sk-proj-"
    $token_openai_2 = "sk-ant-"
    $wallet_metamask = "MetaMask" nocase
    $wallet_phantom = "Phantom" nocase
    $wallet_rabby = "Rabby" nocase
    $wallet_keplr = "Keplr" nocase
    $bip_wif = "WIF" nocase
    $bip_xprv = "xprv" nocase
    $ssh_key = "PRIVATE KEY"
    $clipboard_api = "vscode.env.clipboard.writeText"
    $child_exec = "child_process.exec"
    $windows_hide = "windowsHide"

  condition:
    ($ext_name_1 or $ext_name_2 or $ext_name_3) and
    3 of ($token_*, $wallet_*, $bip_*, $ssh_key)
}

title: VS Code Extension Host Spawning Python or Making Suspicious Network Calls
id: 7a3c1f2e-2026-0810-4931-000000000001
status: experimental
description: Detects VS Code extension host processes spawning Python interpreters or making outbound connections consistent with Solidity Pro stealer behaviour
author: Adverse Trace
date: 2026/08/10
references:

  - https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
logsource:
  product: windows
  category: process_creation
detection:
  selection_spawn_python:
    ParentImage|contains:

      - 'code.exe'
      - 'cursor.exe'
      - 'windsurf.exe'
      - 'codium.exe'
    Image|endswith:

      - 'python.exe'
      - 'python3.exe'
  condition: selection_spawn_python
falsepositives:

  - Legitimate VS Code extensions that invoke Python (e.g. Python language servers, linters)
level: medium

title: NPM Postinstall Hook Executing Remote Payload via child_process
id: 7a3c1f2e-2026-0810-4931-000000000002
status: experimental
description: Detects npm postinstall scripts executing child_process.exec with windowsHide flag, consistent with ascii-fetcher / @jaymara/jsononifier behaviour
author: Adverse Trace
date: 2026/08/10
references:

  - https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
logsource:
  product: windows
  category: process_creation
detection:
  selection_npm_childexec:
    CommandLine|contains:

      - 'child_process.exec'
      - 'windowsHide'
    ParentImage|endswith:

      - 'node.exe'
      - 'npm.exe'
  condition: selection_npm_childexec
falsepositives:

  - Legitimate npm packages using postinstall hooks with child_process (rare)
level: high

7. Sources

• The Hacker News, "Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials," https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html, 2026-08-10

8. Adverse Trace position

This is a high-impact supply-chain compromise targeting developer workstations in the Web3/Solidity ecosystem. The stealer is comprehensive — covering cloud provider credentials, source-control tokens, SSH keys, MFA tokens, and cryptocurrency wallets — and the delayed-activation plus IIFE-based obfuscation design makes it difficult to detect through static scanning alone. EMEA financial services with blockchain, DeFi, or Web3 development teams should treat this as a P1 credential-exposure event: any workstation that ran these extensions must be considered fully compromised and all exposed credentials rotated. The link to WhiteCobra is unconfirmed and based on playbook similarity only. We will monitor for additional IOCs (Cloudflare Workers endpoints, Telegram bot tokens) and for any follow-on reporting from Yeeth Security or corroborating vendors. Single-sourced; verify before enforcement.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.