Fake 'Solidity Pro' VS Code Extensions Caught Emptying Crypto Wallets
Two look-alike extensions posed as tools for Ethereum developers, then quietly installed wallet and credential stealers on the machines that trusted them.
Key points
- Two malicious Visual Studio Code extensions published under the name "Solidity Pro" were caught stealing browser wallets, API keys and saved credentials from developers' machines.
- The extensions were listed on Open VSX as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, and have now been pulled.
- Solidity is the programming language used to write Ethereum smart contracts, so the fake tools were aimed squarely at cryptocurrency developers.
- Researchers found stealer code in a linked GitHub repository, which pulled a second payload once the extension was installed.
- Anyone who installed either extension should treat every wallet, API key and browser password on that machine as burned.
Two malicious extensions for Microsoft's Visual Studio Code, the free code editor used by millions of developers, have been caught stealing cryptocurrency wallets and login credentials from their installers.
Both were published under the name "Solidity Pro", a nod to Solidity, the programming language used to build Ethereum smart contracts. Developers searching for a Solidity helper found something that looked legitimate and installed it.
The listings appeared on Open VSX, the open marketplace that supplies extensions to VS Code and its forks, published as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Both have since been removed, though the linked GitHub repository was still reachable when researchers flagged the campaign. It's a pattern we've seen before: our 4 August story "77 fake developer tools on Open VSX quietly mapped coders' machines for a week" found counterfeit extensions doing the same name-borrowing trick, phoning home to a domain registered days earlier.
What did the extensions actually do?
They installed an infostealer, software designed to quietly copy sensitive data off the victim's machine and send it to the attacker.
Once loaded into VS Code, the extension reached out to a GitHub repository and pulled down a second-stage payload. That payload went hunting for browser wallets (extensions like MetaMask that hold cryptocurrency), saved browser passwords, session cookies and API keys. API keys are the long secret strings that let software log in to cloud services without a password prompt.
For a working crypto developer, that's close to a worst-case haul. Browser wallets hold real money. Session cookies let an attacker walk into an account without triggering a login. Compromised API keys open exchanges and cloud infrastructure.
Who is at risk?
Anyone who installed either extension, on any personal or corporate machine. The install count hasn't been published, but the target audience is narrow and high-value: Ethereum and Web3 developers.
| Detail | Value |
|---|---|
| Malicious extension 1 | helper-beeps.solidity-pro |
| Malicious extension 2 | web3devtoolsx.solidity-pro |
| Marketplace | Open VSX |
| Payload type | Wallet and credential stealer |
| Status | Removed from Open VSX |
How did fake extensions get published in the first place?
Open VSX, like most software marketplaces, doesn't manually vet every submission. Attackers exploit this by publishing packages with names that ride on the reputation of a real tool. It's the same pattern seen for years on npm and PyPI, the package registries for JavaScript and Python: pick a name a developer might plausibly type, wait for installs.
There is no legitimate extension called "Solidity Pro" from a known publisher. The name was the bait, full stop.
What affected developers should do
If either extension touched your machine, assume the credentials on it are compromised.
Move any cryptocurrency out of browser wallets that were active on the affected computer, using a clean device to create the new wallet. Rotate every API key stored in your projects or environment files. Sign out of every browser session and change passwords for anything the browser had saved, starting with email, exchanges and cloud consoles.
Uninstall the extension, and consider a full OS reinstall if the machine held serious keys. Stealer malware rarely limits itself to what it advertises.
Check your VS Code extension list now. If "Solidity Pro" is there, it shouldn't be.
