Fake 'Solidity Pro' VS Code Extensions Caught Emptying Crypto Wallets
Two look-alike extensions posed as tools for Ethereum developers, then quietly installed wallet and password stealers on the machines that trusted them.
Key points
- Two malicious Visual Studio Code extensions published under the name "Solidity Pro" were caught stealing browser wallets, API keys and saved credentials from developers' machines.
- The extensions were listed on Open VSX as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, and have now been pulled.
- Solidity is the programming language used to write Ethereum smart contracts, so the fake tools were aimed squarely at cryptocurrency developers.
- Researchers found the stealer code hosted in a linked GitHub repository, which pulled a second payload once the extension was installed.
- Anyone who installed either extension should treat every wallet, API key and browser password on that machine as burned.
Two malicious extensions for Microsoft's Visual Studio Code, the free code editor used by millions of developers, have been caught stealing cryptocurrency wallets and login credentials from the people who installed them.
Both were published under the name "Solidity Pro", a nod to Solidity, the programming language used to build Ethereum smart contracts. The naming was the whole trick: developers searching for a Solidity helper tool found something that looked legitimate, and installed it.
The listings appeared on Open VSX, the open marketplace that supplies extensions to VS Code and its forks. They were published as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Both have since been removed, though the linked GitHub repository was still reachable when researchers at The Hacker News flagged the campaign.
What did the extensions actually do?
They installed an infostealer, meaning software designed to quietly copy sensitive data off the victim's computer and send it to the attacker.
Once loaded into VS Code, the extension reached out to a repository on GitHub and pulled down a second stage payload. That payload went hunting for browser wallets (the extensions people use to hold cryptocurrency, such as MetaMask), saved browser passwords, session cookies, and API keys, the long secret strings that let software log in to cloud services without a password.
For a working crypto developer, that is close to a worst-case haul. API keys unlock exchanges and cloud infrastructure. Browser wallets hold real money. Session cookies let an attacker walk into an account without triggering a login prompt.
Who is at risk?
Anyone who installed either extension on any machine, personal or work. The number of installs has not been published, but the target audience is narrow and high value: Ethereum and Web3 developers.
| Detail | Value |
|---|---|
| Malicious extension 1 | helper-beeps.solidity-pro |
| Malicious extension 2 | web3devtoolsx.solidity-pro |
| Marketplace | Open VSX |
| Payload type | Wallet and credential stealer |
| Status | Removed from Open VSX |
How did fake extensions get published in the first place?
Open VSX, like most software marketplaces, does not manually vet every submission. Attackers exploit this by publishing packages with names that ride on the reputation of a real tool. It is the same pattern seen for years on npm and PyPI, the package registries for JavaScript and Python: pick a name a developer might plausibly type, wait for the installs.
There is no legitimate extension called "Solidity Pro" from a known publisher. The name was the bait.
What affected developers should do
If either extension touched your machine, assume the credentials on it are compromised.
Move any cryptocurrency out of browser wallets that were active on the affected computer, using a clean device to create the new wallet. Rotate every API key stored in your projects, environment variables or password manager. Sign out of every browser session and change the passwords for anything the browser had saved, starting with email, exchanges, GitHub and cloud consoles.
Then uninstall the extension, and consider a full reinstall of the operating system if the machine held serious keys. Stealer malware rarely limits itself to what it advertises.
Check your VS Code extensions list today. If "Solidity Pro" is there, it should not be.
