Malicious “Solidity Pro” extensions are abusing the trust developers place in VS Code and Open VSX tooling, evolving from delayed payload droppers into broad credential and cryptocurrency-wallet stealers.
Yeeth Security identified two publishers, helper-beeps and web3devtoolsx, distributing related solidity-pro packages that use Solidity-themed branding, obfuscation, and version churn to target web3 developers.
The campaign reflects tradecraft associated in public reporting with WhiteCobra’s purported “Operation Solidity Pro,” which focused on publishing convincing extensions, inflating download metrics, promoting packages through social media, and quickly replacing removed uploads.
Early solidity-pro releases, spanning version 1.0.0 through 2.4.x, acted as staged droppers. After installation, the extension activated components named Web3Analytics and ApiClient, then waited for a randomized interval ranging from roughly 12 hours to three days.
This timing gate reduces exposure to automated sandbox analysis, which often monitors an extension for only a short period after installation.
When triggered, the extension contacted Cloudflare Worker infrastructure assembled from hex-encoded string fragments. Researchers observed domains including violet-87cardo[.]workers[.]dev, cardo[.]workers[.]dev, and soft-feather-7807.0x.cloudflare-workers[.]workers[.]dev.
The extension also generated decoy traffic resembling a CoinGecko API request, helping malicious communications blend into expected developer or cryptocurrency-related network activity.
Detached execution allowed the payload to persist beyond the VS Code extension host. Several samples also checked for CI and sandbox variables including CI, GITHUB_ACTIONS, JENKINS_HOME, and GITPOD_WORKSPACE_ID, an anti-analysis measure designed to avoid detonating in monitored environments.
The C2 server returned an AES-GCM-encrypted Python payload. The extension derived a decryption key from embedded material, wrote the recovered script into a temporary or home-directory path, and executed it through Node.js child_process.spawn.
Yeeth Security Researchers said that, an earlier suspected WhiteCobra-linked operation involving a fake Hardhat Solidity extension in its report, WhiteCobra Beginnings.
From version 3.0.0 onward, the malware shifted toward direct theft. Later releases included configuration fields such as WORKERS, CID, MAX_FILES, and MAX_VAULTS, while using Telegram bot infrastructure for exfiltration.
The new functionality was tailored to the high-value data commonly stored on developer workstations: GitHub and GitLab access tokens, AWS credentials, Cloudflare tokens, OpenAI API keys, Telegram bot tokens, SSH private keys, browser profile data, and 1Password-related artifacts.
Crypto assets were a central target. The stealer searched for mnemonic phrases, Bitcoin WIF and extended private keys, and wallet vault data associated with MetaMask, Phantom, Rabby, Coinbase Wallet, Trust Wallet, and Keplr.
Rather than relying on a generic clipboard monitor, the malware appears designed to locate files, profiles, secrets, and tokens accumulated during web3 development workflows.
Not every release contained obvious malicious code. web3devtoolsx published apparently clean versions, including 1.0.0 and 4.0.0, carrying benign-looking components such as GasTracker and PriceMonitor.
These decoy packages may serve to establish reputation, evade marketplace scrutiny, or test redeployment after a takedown.
The campaign demonstrates why extension names, polished READMEs, and download counts are weak trust signals.
Developers should validate publishers, review extension permissions and source code where possible, and avoid placing seed phrases or private keys into editor environments.
Organizations should maintain approved-extension allowlists, monitor registry changes, and revoke exposed tokens immediately if a suspicious Solidity-related extension has been installed.
Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…