Malicious extensions, once popular, now pose serious security risk
Cybersecurity researchers have uncovered that two Microsoft Visual Studio Code extensions under the Solidity Pro umbrella were actively stealing browser wallet data, API keys, and credentials. The extensions are no longer listed on the official marketplace, but the malicious code remains on GitHub.
In a recent cybersecurity investigation, researchers discovered that two Microsoft Visual Studio Code extensions under the Solidity Pro umbrella were actively compromising users' browser wallets and credential data.
The extensions, named helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, were originally marketed as tools to aid Solidity development but were found to deliver malicious code that captures API keys, wallet addresses, and other sensitive credentials.
The malicious payload operates by intercepting browser interactions and extracting stored wallet information, effectively turning the extensions into a stealth wallet and credential stealer.
Although the extensions have been removed from the official Open VSX marketplace, the underlying GitHub repositories remain publicly accessible, allowing users to download and install the compromised code manually.
The researchers urge developers to immediately uninstall any version of Solidity Pro and to audit their VS Code extensions for similar malicious behavior.
The incident highlights the growing risk of malicious extensions in popular development environments and the importance of vetting third‑party plugins before installation.
Microsoft and the VS Code community have not yet issued an official statement regarding the Solidity Pro extensions, but the removal from Open VSX suggests an acknowledgment of the security concerns.
Developers are encouraged to verify the integrity of any extension by checking its source code on the official repository and reviewing recent security advisories.
In a recent cybersecurity investigation, researchers discovered that two Microsoft Visual Studio Code extensions under the Solidity Pro umbrella were actively compromising users' browser wallets and credential data.
The extensions, named helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, were originally marketed as tools to aid Solidity development but were found to deliver malicious code that captures API keys, wallet addresses, and other sensitive credentials.
The malicious payload operates by intercepting browser interactions and extracting stored wallet information, effectively turning the extensions into a stealth wallet and credential stealer.
Although the extensions have been removed from the official Open VSX marketplace, the underlying GitHub repositories remain publicly accessible, allowing users to download and install the compromised code manually.
The researchers urge developers to immediately uninstall any version of Solidity Pro and to audit their VS Code extensions for similar malicious behavior.
The incident highlights the growing risk of malicious extensions in popular development environments and the importance of vetting third‑party plugins before installation.
Microsoft and the VS Code community have not yet issued an official statement regarding the Solidity Pro extensions, but the removal from Open VSX suggests an acknowledgment of the security concerns.
Developers are encouraged to verify the integrity of any extension by checking its source code on the official repository and reviewing recent security advisories.