Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro (“solidity-pro”) that has been observed delivering a browser wallet and credential stealer.
The names of the extensions are below –
- helper-beeps.solidity-pro
- web3devtoolsx.solidity-pro
Although neither of the extensions is now available on Open VSX, the GitHub repository for “web3devtoolsx/solidity-pro” continues to remain accessible as of writing.
According to Yeeth Security, early iterations of the extensions – from 1.0.0 through v2.4.x – were found to beacon to Cloudflare Workers endpoints to retrieve an encrypted Python payload and execute it.
Subsequent versions starting with v3.0.0, on the other hand, have shifted to a full-blown information stealer that can collect browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The captured data is then exfiltrated via a Telegram bot upload.
The list of data harvested by the stealer is as follows –
- GitHub ghp_ and github_pat_ tokens
- GitLab glpat- tokens
- AWS keys and session tokens
- Cloudflare cfat_ tokens
- OpenAI sk-, sk-proj-, and sk-ant- keys
- Telegram bot tokens
- Mnemonic and seed phrases
- MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr wallet vaults
- Bitcoin WIF / xprv
- SSH private keys (PRIVATE KEY)
- URL credentials and 1Password MFA tokens
The malware family is also equipped to bypass marketplace review, static scanning, and casual sandboxing through heavy obfuscation, intermediate clean versions to build trust, and randomized delayed activation that causes the malicious code to run several hours or days after installation.
“By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on,” Yeeth Security said. “The obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target.”
The cybersecurity company said the activity shares the same high-level playbook as WhiteCobra, another threat cluster that was detected in September 2025 as distributing Lumma Stealer through malicious VS Code extensions.
This is not the first time threat actors have published bogus Solidity extensions across open-source ecosystems. In June 2026, Yeeth Security flagged another extension named “ethdevtools.solidity-language-support” that impersonated a Solidity language-support tool for Ethereum developers, but harbored a delayed-activation clipboard stealer to scrape BIP-39 seed phrases, Ethereum private keys, and wallet addresses.
“When a recognized crypto address is on the clipboard, it replaces the pasted value with an attacker-controlled address,” it added. “The swap happens through vscode.env.clipboard.writeText, a first-party API call that requires no child_process, no network access, and no file writes. Static scanners that only look for dangerous Node imports will not see it.”
The findings also coincide with the discovery of a number of rogue VS Code extensions and npm packages –
- An npm package called “ascii-fetcher,” which embeds the malicious code in a dependency named “@jaymara/jsononifier” to decode an embedded command (in the observed case, “calc.exe”) and run it via “child_process.exec” with “windowsHide”
- A set of 10 VS Code extensions that deliver a wide range of Windows-based BAT, JavaScript, and HTA droppers, with two of them bundling an npm dependency that uses a postinstall hook to fetch and execute a remote payload
- A VS Code extension named “DigitalBarberTrim.html-entity-codec” that drops a remote VSIX file in select versions after enumerating known VS Code forks like Cursor, Windsurf, Codium, and Positron, while serving a “nearly empty stub” in others to fly under the radar.
- A VS Code extension named “Zlmiles.zlmiles-liquid” (now removed from the VS Marketplace) that makes use of a suspected builder kit to drop an MSI installer hosted on a Replit domain.
Users who have installed the extensions are advised to remove them, inspect dependency graphs, block known command-and-control (C2) domains, and alert on use of cscript, mshta, cmd, curl, and powershell commands.
