Fifteen Rogue JetBrains Plugins Posed as DeepSeek Assistants to Siphon AI Keys

Someone went shopping for developer credentials, and they did it the lazy way: by publishing fake AI coding assistants on the JetBrains Marketplace.

Researchers have flagged at least 15 malicious plugins, all marketed as DeepSeek-powered (and a few other LLMs) coding helpers offering the usual buffet — chat, commit-message generation, code review, bug finding, unit test scaffolding. The actual job description was different. The plugins existed to exfiltrate AI provider API keys from the IDEs of developers who installed them.

If that sounds familiar, it should. This is the same playbook we've seen on the VS Code Marketplace, npm, and PyPI for years: typosquat a trendy name, ship something that mostly works, harvest secrets in the background. The novelty here isn't the technique. It's the target. AI API keys are the new AWS keys.

And they're worth real money. A leaked OpenAI or Anthropic key can be resold, fed into a reverse-proxy operation like the ones DeepSeek and Claude resellers have been running on Telegram, or simply burned for free inference until the rate limits scream. Stolen keys for frontier models have appeared in underground markets at meaningful prices, because the buyer doesn't need to launder anything — they just need a working token.

The attack surface is mundane. JetBrains plugins run with the same privileges as the IDE. That means access to your project files, your environment variables, your .env, your shell history if the plugin feels ambitious. A plugin that legitimately needs an OpenAI key to function is a plugin that has a perfectly normal-looking reason to read one and phone home. Think of it as a supply-chain compromise dressed in a chatbot costume.

What makes the campaign worth flagging as coordinated rather than opportunistic: 15 plugins is a lot. That suggests shared infrastructure, shared exfil endpoints, or at minimum a shared author network gaming the marketplace's review process.

A few things developers and security teams should actually do:

• Audit installed JetBrains plugins now. Anything unfamiliar that mentions DeepSeek, AI assistants, or generic "LLM helper" branding deserves a hard look.
• Rotate any AI provider keys that have been sitting in IDE configs, .env files, or shell profiles on machines where unvetted plugins were installed.
• Treat AI API keys like cloud credentials. Scope them, rate-limit them at the provider side, and put them in a secrets manager rather than plaintext config.
• Watch provider billing dashboards. Unexpected token spend is often the first signal a key has walked.

JetBrains, for its part, will need to tighten marketplace review. The pattern of "LLM wrapper as malware delivery vehicle" is going to keep working until the platforms hosting these plugins start treating AI-branded submissions with the same suspicion they'd apply to a new wallet extension.

The IDE is the new browser. The plugin store is the new extension store. The attackers already figured that out.