Solidity Pro VS Code Extension Steals Crypto Wallets, API Keys, and SSH Credentials

Cybersecurity researchers have flagged a malicious Visual Studio Code extension called Solidity Pro that steals cryptocurrency wallet data, credentials, and access keys. The threat affects two packages — helper-beeps.solidity-pro and web3devtoolsx.solidity-pro — both of which have been removed from the Open VSX registry, though the GitHub repository for the latter remains accessible.

Experts at Yeeth Security found that early versions of the extension, from 1.0.0 through v2.4.x, communicated with Cloudflare Workers endpoints to retrieve and execute an encrypted Python payload. Starting with version v3.0.0, the malware shifted to a full-fledged stealer capable of harvesting browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The collected data is exfiltrated via a Telegram bot upload.

Among the stolen information are GitHub tokens (ghp_ and github_pat_), GitLab tokens (glpat-), AWS keys and session tokens, Cloudflare tokens (cfat_), OpenAI keys (sk-, sk-proj-, sk-ant-), Telegram bot tokens, mnemonic and seed phrases, wallet vaults from MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr, Bitcoin WIF and xprv keys, private SSH keys, as well as URL credentials and 1Password MFA tokens.

The malware bypasses marketplace review, static scanning, and casual sandboxing through heavy obfuscation, intermediate clean versions to build trust, and randomized delayed activation that runs the malicious code several hours or days after installation. By the time the malicious branch executes, users have already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on. The obfuscation splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases, making signature-based detection a moving target.

According to Yeeth Security, the activity follows the same playbook as the WhiteCobra cluster, detected in September 2025 distributing Lumma Stealer through malicious VS Code extensions. This is not the first time fake Solidity extensions have appeared in open-source ecosystems: in June 2026, the company flagged a similar extension called ethdevtools.sol.