Fake Solidity Pro VS Code Extensions Steal Crypto Wallets and API Keys

Malicious VS Code extensions published under the name "Solidity Pro" are exfiltrating crypto wallet credentials, API keys, and SSH keys from smart contract developers, according to cybersecurity researchers cited by The Hacker News. The packages impersonate a legitimate Solidity tool inside one of the most widely used IDEs in Web3. This is a supply-chain attack on the toolchain itself, not on a single contract.

The attack surface

VS Code extensions execute with the user's full local privileges. There is no sandbox. An extension can read arbitrary files, open outbound sockets, and run scripts under the developer's identity. The trust boundary between publisher and developer collapses the moment the extension is installed.

A Solidity developer's workstation typically concentrates: hot wallet mnemonics and keystores, hardware wallet companion files, RPC endpoint URLs, API keys for node providers, .env files containing deployer credentials, and SSH keys for GitHub, CI runners, and production servers. Any extension with filesystem read access can enumerate the home directory and ship the contents to an attacker-controlled endpoint. The exfiltration is silent.

Verify the install

Uninstall any extension named "Solidity Pro" or visually matching its branding. Marketplace ratings and install counts are not a defense. Typosquatting is the default pattern, and cloned publisher metadata is trivial.

Open the Extensions panel. Search for "Solidity". Cross-reference each result against the verified publisher on the marketplace page. Confirm the publisher domain against the project's official GitHub. If the publisher is unknown, if the domain does not resolve to the expected organization, or if the extension was recently published, treat it as hostile and remove it. Also check for parallel installs under slightly altered names — these are common in coordinated drops.

Then rotate. Assume compromise. Generate new keys for any wallet that touched the affected machine. Revoke and reissue API tokens for node providers. Replace SSH keys and remove the public ones from authorized hosts. Move funds off any hot wallet that lived on the workstation. Reissue deployer credentials and audit recent on-chain transactions for unauthorized approvals or transfers.

Toolchain hygiene

Plaintext secrets on disk are a single point of failure. Push deployment configuration through environment variables injected by CI, not committed to the repo. Use a secrets manager or an encrypted vault for anything that must persist locally. Treat the IDE as a trusted dependency: pin extension versions, review changelogs before updating, and subscribe to publisher alerts. A compromised extension can stay dormant for weeks before beaconing, which is why rotation matters more than retrospective detection.