A malicious VS Code extension called Solidity Pro has been caught stealing crypto wallets, API keys, and credentials. Learn how to protect yourself before it's too late.
If you're a developer working with Solidity, you've probably spent time browsing the Visual Studio Code marketplace for tools that make your life easier. Extensions are supposed to save time, not ruin your entire digital life. But a recent discovery shows just how dangerous a seemingly innocent plugin can be.
Security researchers have flagged a malicious VS Code extension called Solidity Pro (identified as "solidity-pro") that's been caught in the act of stealing browser wallets, API keys, and login credentials. And here's the scary part: it was hiding in plain sight, looking like a legitimate developer tool.
This isn't some obscure, hard-to-find piece of malware. It was distributed through the official Open VSX registry, which is where thousands of developers go to find trusted extensions. If you've ever installed a Solidity tool from there, this is worth your full attention.
### The Malicious Extensions You Need to Know About
The researchers identified two specific extensions tied to this threat:
- **helper-beeps.solidity-pro**
- **web3devtoolsx.solidity-pro**
Both of these have since been pulled from Open VSX, which is good news. But here's the kicker: the GitHub repository linked to these extensions is still out there. That means the code is still circulating, and there's nothing stopping someone from repackaging it under a new name and pushing it back to a marketplace.
If you've ever installed either of these, you need to treat your machine as compromised. That's not me being dramatic—that's the reality of dealing with a credential stealer.
### What Exactly Does This Malware Do?
Let's break down what happens when this thing gets on your system. It's not just a minor annoyance; it's a full-blown data thief.
First, it targets your browser wallet. If you use MetaMask, Phantom, or any other browser-based crypto wallet, the malware is designed to grab your private keys and seed phrases. Once that happens, your funds are gone. There's no reversal, no customer support line to call. It's just gone.
Second, it hunts for API keys. If you've got keys stored in your development environment—think AWS, GitHub, or any cloud service—this thing wants them. With those keys, an attacker can spin up expensive cloud resources on your dime or access your private repositories.
Third, it collects stored credentials. That includes saved passwords in your browser, session tokens, and anything else that could give an attacker a way into your accounts. It's a comprehensive sweep of everything sensitive on your machine.
### Why Developers Are Prime Targets
Here's the thing: developers are a high-value target. We hold the keys to production systems, we have access to company infrastructure, and we often handle sensitive data for hundreds or thousands of users. One compromised developer machine can lead to a massive supply chain attack.
And the crypto angle makes it even worse. If you're building on Ethereum or any other blockchain, you're likely holding tokens or managing smart contracts that are worth real money. An attacker doesn't need to hack a centralized exchange if they can just steal your private keys directly.
### How to Protect Yourself Right Now
If you think you might have installed one of these extensions, don't wait. Here's what you need to do immediately:
1. **Uninstall the extension** from VS Code right now. Go to the Extensions panel, search for "solidity-pro," and remove anything that matches.
2. **Change your passwords** for every account you've accessed on that machine. And I mean every single one. Use a password manager to generate strong, unique passwords.
3. **Rotate your API keys** for any cloud services or development tools you use. Don't just delete them—revoke them and create new ones.
4. **Move your crypto assets** to a hardware wallet or a fresh software wallet that has never touched that machine. Transfer everything out, even if it's a small amount.
5. **Scan your system** with a reputable antivirus or anti-malware tool. This won't catch everything, but it's a good first step.
### The Bigger Lesson Here
This whole situation is a reminder that the tools we trust can turn on us. The VS Code extension marketplace is generally safe, but it's not immune to bad actors. The same goes for any package manager or plugin registry.
Before you install anything, take a second to check the publisher. Look at the download count, read the reviews, and verify the GitHub repository. If something feels off—if the extension has very few downloads but claims to do a lot—trust your gut.
And never, ever store sensitive credentials in plain text files or in your development environment. Use environment variables, use a secret manager, and use hardware wallets for anything that holds real value.
The developers who built Solidity Pro knew exactly what they were doing. They picked a name that sounds legitimate, they made it look useful, and they waited for victims to come to them. Don't be the next one.
Stay sharp out there. The tools you use every day are powerful, but they're only as safe as the people who build them.
