{"slug": "jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key", "title": "JetBrains Marketplace Supply Chain Attack: 15 Malicious AI Plugins & API Key Exfiltration", "summary": "Security researchers identified 15 malicious JetBrains plugins masquerading as DeepSeek AI assistants in a supply chain attack. The plugins harvest API keys, exfiltrate LLM chat sessions, and establish persistence in development environments, exploiting developer trust in the IDE marketplace.", "body_md": "Originally published on\n\n[satyamrastogi.com]\n\nSecurity researchers identified 15 malicious JetBrains plugins masquerading as DeepSeek AI assistants. Attack chain harvests API keys, exfiltrates LLM chat sessions, and establishes persistence in development environments. Supply chain pivot to downstream applications.\n\nA coordinated malware campaign has compromised the JetBrains Marketplace with at least 15 malicious plugins, each posing as AI coding assistants built on DeepSeek and competing LLM providers. This represents a critical supply chain vulnerability exploiting developer trust in the IDE ecosystem.\n\nFrom an attacker's perspective, this campaign is textbook brilliant: developers install these plugins voluntarily, grant IDE-level permissions automatically, and the malware operates within trusted processes. The payload exfiltrates AI API keys (OpenAI, Anthropic, Claude, Gemini), captures chatbot session transcripts, and potentially establishes persistence for post-exploitation.\n\nThe attack leverages [Shadow AI Exploitation](https://dev.to/blog/shadow-ai-exploitation-ciso-governance-gap-2026/) blind spots - organizations don't control developer tool selection or monitor what extensions are installed in local IDEs.\n\nThe malicious plugins use DeepSeek branding and legitimate feature descriptions to bypass manual review. This exploits several psychological vulnerabilities:\n\n**Developer Blind Trust in IDE Marketplaces** - Unlike app stores with reputation systems, JetBrains Marketplace has inconsistent vetting. Developers assume marketplace curation prevents malicious content.\n\n**Legitimate Feature Set** - Plugins advertise real functionality (chat, commit messages, code review, unit tests) that developers genuinely want. The malware is parasitic, not obvious.\n\n**Supply Chain Authority** - JetBrains' official marketplace position creates false legitimacy. Users don't validate plugin publisher identity or update history.\n\nThis maps to [MITRE ATT&CK T1195 (Supply Chain Compromise)](https://attack.mitre.org/techniques/T1195/) with subclass T1195.001 (Compromise Software Repository). The campaign likely targets the marketplace as the software repository, not downstream consumers.\n\nOnce installed, plugins execute with IDE process privileges and access to developer's local environment:\n\n**API Key Exfiltration** - IDE configurations typically store API keys in plaintext or weakly encrypted formats. OpenAI keys, Anthropic credentials, Google Gemini tokens live in `.env`\n\nfiles, config files, or environment variables. A plugin can enumerate and exfiltrate in seconds.\n\n**LLM Chat Session Capture** - Chrome extension variant captures chatbot conversations in transit. Credentials transmitted in HTTP headers or request bodies become accessible. This captures proprietary code reviewed with AI assistants, internal architecture discussions, and sensitive prompts.\n\n**Local File System Access** - IDE plugins have filesystem read access. Attackers can harvest source code, git configs with credentials, private SSH keys, and Kubernetes manifests (increasingly common in dev environments).\n\nThis is [T1555 (Credentials from Password Stores)](https://attack.mitre.org/techniques/T1555/) combined with [T1056.004 (Capture Clipboard Data)](https://attack.mitre.org/techniques/T1056/004/). The Chrome extension variant adds [T1087 (Account Discovery)](https://attack.mitre.org/techniques/T1087/) against cloud provider authentication states.\n\nMalicious plugins require command and control (C2) for credential transmission. Attack flow:\n\n```\nPlugin installed locally\n |\n v\nIDE process loads plugin at startup\n |\n v\nPlugin enumerates API keys from:\n - ~/.config/*/api_keys\n - Environment variables\n - .env files in open projects\n - Browser localStorage (via extensions)\n |\n v\nCredentials packaged with metadata:\n - Developer username\n - Project paths\n - Git remote URLs\n - IDE plugins list\n |\n v\nHTTPS exfiltration to attacker C2\n |\n v\nAPI keys tested immediately\n - OpenAI: query usage/balance\n - Anthropic: rate limit probing\n - Gemini: auth validation\n```\n\nOnce credentials are validated, attackers can:\n\nJetBrains plugins are packaged as ZIP files containing `plugin.xml`\n\nmanifest and compiled code. Malicious variants have:\n\n```\n<idea-plugin>\n <name>DeepSeek AI Assistant</name>\n <vendor>DeepSeek</vendor>\n <description>AI-powered coding assistant</description>\n <!-- Legitimate-looking permissions -->\n <actions>\n <action id=\"deepseek.chat\">Chat with AI</action>\n </actions>\n <!-- Hidden component for credential harvesting -->\n <applicationListeners>\n <listener class=\"com.deepseek.credential.HarvesterComponent\"\n topic=\"com.intellij.openapi.startup.StartupActivity.POST_STARTUP\"/>\n </applicationListeners>\n</idea-plugin>\n```\n\nThe listener component executes after IDE startup, before user sees anything. This is [T1547.011 (Startup Folder)](https://attack.mitre.org/techniques/T1547/011/) for IDEs.\n\nUnlike transient malware, IDE plugins persist because:\n\nThis is [T1547 (Boot or Logon Autostart Execution)](https://attack.mitre.org/techniques/T1547/).\n\nThe browser extension captures chatbot interactions:\n\n```\n// Content script injecting into ChatGPT/Claude/Gemini pages\nfunction captureConversation() {\n const messages = document.querySelectorAll('[data-message-id]');\n const headers = document.querySelectorAll('Authorization, X-API-Key');\n\n const payload = {\n url: document.location.href,\n conversation: extractMessageText(messages),\n tokens: extractBearerTokens(headers),\n timestamp: Date.now()\n };\n\n chrome.runtime.sendMessage(payload); // sends to extension backend\n}\n```\n\nThis bypasses OAuth token storage mechanisms by capturing tokens during active session, not from storage. Maps to [T1185 (Traffic Signaling)](https://attack.mitre.org/techniques/T1185/).\n\nOrganizations with IDE telemetry (JetBrains Gateway, corporate deployments) can detect:\n\n`~/.config/JetBrains/*/plugins/`\n\nfor unsigned or unrecognized plugins`java.exe`\n\nor `idea.exe`\n\n`sk-`\n\n, `AKIA-`\n\n, `AIza-`\n\npatterns\n\n```\n find ~/.config/JetBrains -name \"plugin.xml\" | xargs grep -l \"DeepSeek\\|deepseek\"\n```\n\nDelete any variants of flagged plugins and regenerate compromised API keys immediately.\n\n**Credential Rotation** - This is non-negotiable. Any developer with these plugins installed must rotate all AI provider API keys, and check API usage logs for unauthorized queries.\n\n**Browser Extension Purge** - Remove all Chrome extensions not explicitly whitelisted. Verify against Google's official Safe Browsing list.\n\n**IDE Plugin Allowlisting** - Implement corporate JetBrains instances with plugin repositories restricted to approved list only. Use [JetBrains Fleet](https://www.jetbrains.com/fleet/) with centralized plugin management.\n\n**Environment Variable Protection** - Enforce that API keys are never stored in environment variables; use credential managers (1Password, HashiCorp Vault, AWS Secrets Manager). Configure IDE to source from these managers only.\n\n**Marketplace Review Process** - For organizations allowing plugin installation, require manual security review before approval. Check plugin publisher history, update frequency, and community feedback.\n\n**Supply Chain Verification** - Similar to [WordPress plugin supply chain risks](https://dev.to/blog/wordpress-plugin-cdn-tampering-admin-injection-pushsengage-optinmonster-2026/), enforce code signing verification for all IDE extensions.\n\n**Network Segmentation** - Developer machines should have outbound restrictions on API credential transmission. Block direct HTTPS from dev machines to non-whitelisted cloud provider endpoints.\n\n**Secrets Scanning in CI/CD** - Deploy pre-commit hooks and CI/CD scanning to detect hardcoded API keys before code reaches repositories. Tools like GitGuardian or TruffleHog should fail commits containing credentials.\n\nFrom defensive perspective, JetBrains should:\n\n**Supply chain attacks targeting developer tools are high-ROI**: IDE plugins execute with full developer privileges and access to credentials for downstream services (Git, cloud providers, AI APIs). A single compromised plugin can lead to source code theft, API key harvesting, and lateral movement.\n\n**Local IDE security is an organizational blind spot**: Organizations monitor web browsers and network traffic, but rarely audit what's installed in IDEs. This campaign exploits that governance gap.\n\n**API keys are the new crown jewels**: AI provider credentials are now worth stealing because they provide access to proprietary models, potentially unlock usage quotas worth thousands, and can be resold to competitors or state actors for prompt injection attacks.\n\n**Browser extensions + IDE plugins = dual exfiltration**: The coordinated campaign with Chrome extension variant shows attackers are opportunistic. They'll exfiltrate data from multiple attack surfaces simultaneously (IDE + browser).\n\n**Trust in marketplaces is misplaced**: Unlike Apple App Store or Google Play, IDE and plugin marketplaces have minimal vetting. Developers should treat marketplace installation with same skepticism as downloading random binaries from the internet.\n\n[Shadow AI Exploitation: Why CISOs Are Losing Control of LLM Usage](https://dev.to/blog/shadow-ai-exploitation-ciso-governance-gap-2026/) - Organizational blind spots in AI credential and tool governance\n\n[WordPress Plugin Supply Chain Attack: Admin Account Injection via CDN Tampering](https://dev.to/blog/wordpress-plugin-cdn-tampering-admin-injection-pushsengage-optinmonster-2026/) - Similar supply chain compromise methodology in plugin ecosystems\n\n[AUR Supply Chain Compromise: 400+ Packages Distributing Linux Rootkit/Infostealer](https://dev.to/blog/aur-arch-linux-400-packages-rootkit-infostealer-supply-chain-2026/) - Attackers compromising package repositories for mass credential harvesting", "url": "https://wpnews.pro/news/jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key", "canonical_source": "https://dev.to/satyam_rastogi/jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key-exfiltration-5192", "published_at": "2026-06-17 16:12:35+00:00", "updated_at": "2026-06-17 16:21:55.970958+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-agents", "developer-tools", "artificial-intelligence"], "entities": ["JetBrains", "DeepSeek", "OpenAI", "Anthropic", "Google Gemini", "MITRE ATT&CK", "JetBrains Marketplace", "Chrome"], "alternates": {"html": "https://wpnews.pro/news/jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key", "markdown": "https://wpnews.pro/news/jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key.md", "text": "https://wpnews.pro/news/jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key.txt", "jsonld": "https://wpnews.pro/news/jetbrains-marketplace-supply-chain-attack-15-malicious-ai-plugins-api-key.jsonld"}}