VS Code Extension Steals Crypto Wallets

Researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro that delivers a browser wallet and credential stealer. The extension appears in the marketplace as “solidity‑pro” and injects code into the editor’s environment, capturing sensitive information such as private keys stored in browser wallets or entered into forms. The stolen data are then sent to an attacker-controlled server for later use.¹

The attackers released two variants of the extension—named helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Neither variant is currently listed on Open VSX, but both remain available via GitHub repositories that can still be cloned by anyone who knows their URLs. Researchers noted that the extensions were not removed from the marketplace before discovery, allowing unsuspecting developers to install them under the guise of legitimate tooling.¹

In addition to wallet theft, the malicious code also harvests API keys and other credentials that developers often keep within VS Code settings files. This broad collection capability means that any developer working with decentralized applications could inadvertently expose secrets used to sign transactions or access blockchain services. The attack vector relies on a reverse shell or proxy mechanism that exfiltrates captured data back to the command-and-control server without triggering typical antivirus alerts.¹

Experts point out that this incident follows a pattern seen earlier: in 2019 several npm packages embedded malware designed to steal AWS credentials from continuous‑integration pipelines. Those attacks targeted developers’ build environments, much like Solidity Pro targets VS Code users. Because “solidity” echoes the name of Solidity, Ethereum’s smart‑contract language, attackers are banking on the familiarity of the term among Web3 communities to lower scrutiny.¹

If an attacker obtains a user’s private key, they can transfer tokens, NFTs, or large amounts of cryptocurrency. Thus, the extension threatens not only small‑scale projects but potentially high‑value assets held by professional dApp developers.¹

Security teams now advise all VS Code users to verify extensions through official channels and avoid installing tools that request unnecessary permissions such as full file system read/write. Microsoft has issued a warning for the Solidity Pro family, urging users to uninstall immediately if present.¹

In short, the Solidity Pro incident underscores how quickly trusted developer tooling can be weaponized against its own audience. Developers must remain vigilant about where they download extensions, what permissions those extensions ask for, and whether any suspicious activity appears in their editor logs. By staying cautious and reporting anomalies promptly, the Web3 ecosystem can mitigate this new vector before it becomes mainstream.