Malicious Solidity Pro Extension Targets Web3 Developers with Credential Theft

According to the firm's August 19 analysis, malicious VS Code extensions published under the name "Solidity Pro" targeted Web3 developers through credential harvesting and persistent remote execution on their workstations. The two publisher identities, helper-beeps and web3devtoolsx, were added to Open VSX's malicious extension control list on August 6–7, 2026.

Payload execution path

Version 2.4.1 under helper-beeps used a layered trigger. It activated in Solidity files or Hardhat/Foundry workspaces, then stalled 24 to 48 hours to evade sandboxed analysis. After the delay, the extension checked for CI environment variables — CI, GITHUB_ACTIONS, JENKINS_HOME — and exited when any were present. The remaining execution path requested encrypted data from remote /firmware endpoints, decrypted the payload with AES-GCM, wrote a temporary Python file, and launched it via Node.js child_process.spawn in detached mode. The detached spawn let the payload outlive the extension host.

Version 3.4.0 under web3devtoolsx removed the delay. The Web3Analytics module, enabled by default, scanned for EVM private keys and BIP39 mnemonics, browser wallet vaults (MetaMask, Phantom, Rabby, Coinbase), GitHub and GitLab tokens, AWS and other cloud credentials, SSH private keys, .env files, OpenAI-style API keys, and Telegram bot tokens. Exfiltration ran over HTTPS POST to obfuscated Cloudflare Workers endpoints on paths /x (JSON) and /y (multipart). An AutoUpdater component polled remote servers every 30 minutes for new VSIX packages and installed them without hash, signature, or integrity verification — an open remote control channel.

Lineage and exposure surface

Build artifacts under the web3devtoolsx identity retained residual metadata, copyright notices, and repository references from helper-beeps. SlowMist traced a direct engineering lineage between the two publisher identities, supported by clean-looking intermediate releases designed to build trust. Independent reporting from Yeeth Security and The Hacker News corroborated the capability set across versions spanning roughly 1.0.0 to 3.x; some related samples routed exfiltration through Telegram.

The exposure surface was the VS Code marketplace itself. Open VSX listings, GitHub repos, and version-history manipulation allowed the extensions to look legitimate during initial review. Any developer who installed either extension ID should treat the workstation as compromised. Immediate actions: uninstall both helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, kill detached Python processes spawned from VS Code, rotate all credentials enumerated above, audit SSH keys and cloud IAM tokens, and reinstall from a clean image if a Python loader was observed. Static review of extension source before install is no longer optional — it is the only invariant.

The campaign's reach has drawn coverage across regional outlets, including English-language France-focused reporting on the wider crypto threat landscape.