Security firm Yeeth Security flagged malicious VS Code extensions distributed under the name “Solidity Pro” that deliver a browser wallet and credential stealer targeting Solidity and Ethereum developers. The extensions, published under the identifiers helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, harvest GitHub tokens, cloud credentials, wallet seeds, and SSH keys, exfiltrating the stolen data through a Telegram bot. Neither extension remains available on Open VSX, though the web3devtoolsx/solidity-pro GitHub repository remains accessible.
How the Solidity Pro Extension Evolved From Loader to Full Stealer
Early versions of the extension, spanning 1.0.0 through 2.4.x, beaconed to Cloudflare Workers endpoints to fetch and execute an encrypted Python payload, according to Yeeth. Version 3.0.0 and later became a full information stealer, expanding the extension’s behavior from an execution loader into an active credential collector.
The Stolen Data Set: Wallets, Cloud Keys, and Session Tokens
The stealer collects GitHub ghp_ and github_pat_ tokens, GitLab glpat- tokens, AWS keys and session tokens, Cloudflare cfat_ tokens, OpenAI sk-, sk-proj-, and sk-ant- keys, and Telegram bot tokens. It also grabs mnemonic and seed phrases, MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallet vaults, Bitcoin WIF and xprv keys, SSH private keys, URL credentials, and 1Password MFA tokens, Yeeth reported. The full credential set is then sent to a Telegram bot.
Delayed Activation and Heavy Obfuscation to Defeat Review
The extensions used multiple evasion layers. Code was heavily obfuscated, with strings split across IIFE tables and reassembled at runtime and method names switched between releases. The operators published intermediate clean versions to build trust, and the malicious branch activated hours or days after installation on a randomized delay, defeating casual review and short-window sandboxing.
The WhiteCobra Playbook and Related Malicious Tooling
Yeeth said the campaign shares its playbook with the WhiteCobra cluster, which was linked to Lumma Stealer delivered through VS Code extensions the prior year. In a related finding from the same research stream, Yeeth flagged ethdevtools.solidity-language-support, an extension with a delayed-activation clipboard stealer that swaps crypto addresses through vscode.env.clipboard.writeText.
The ascii-fetcher npm Package and Hidden Command Execution
Beyond the extensions, Yeeth identified the npm package ascii-fetcher, which contains malicious code in its dependency @jaymara/jsononifier. That dependency executes an embedded command through child_process.exec with windowsHide, allowing a seemingly innocuous install to run attacker code without a visible console window.
Additional Rogue Extensions and the Fork-Enumeration VSIX Dropper
The firm also reported ten additional VS Code extensions delivering Windows BAT, JavaScript, and HTA droppers, two of which bundle an npm postinstall hook. One extension, DigitalBarberTrim.html-entity-codec, drops a remote VSIX in select versions after enumerating which VS Code forks are in use, including Cursor, Windsurf, Codium, and Positron, tailoring the payload to the running editor.
Removing the Threat and the Limits of Marketplace Review
Developers who installed the Solidity Pro extensions should remove them, inspect dependency graphs for the named packages, and watch for execution of cscript, mshta, cmd, curl, and powershell, according to Yeeth’s guidance. Blocking the known command-and-control domains is also advised.
Solidity Pro’s Targeting of Developer Authority and Wallet Ownership
The credential set targeted by the campaign maps directly to developer authority: source-control tokens grant repository access, cloud keys grant infrastructure control, and wallet seeds grant ownership of funds. A single compromised developer machine can therefore cascade into both crypto theft and a supply-chain foothold inside an organization’s build environment.
The Solidity Pro Delayed-Activation Trick and Marketplace Verification
The randomized timing and trust-building versions show that marketplace moderation alone cannot catch malicious extensions that behave cleanly until after install. For security teams, the practical consequence is that extension supply chains require the same verification discipline as software packages: provenance checks, allow-list management, and behavioral monitoring rather than reliance on listing review. The repeated emergence of credential-stealing extensions aimed at developers indicates this remains a favored attack surface.
