JetBrains Marketplace Supply Chain Attack: 15 Malicious AI Plugins & API Key Exfiltration Security researchers identified 15 malicious JetBrains plugins masquerading as DeepSeek AI assistants in a supply chain attack. The plugins harvest API keys, exfiltrate LLM chat sessions, and establish persistence in development environments, exploiting developer trust in the IDE marketplace. Originally published on satyamrastogi.com Security researchers identified 15 malicious JetBrains plugins masquerading as DeepSeek AI assistants. Attack chain harvests API keys, exfiltrates LLM chat sessions, and establishes persistence in development environments. Supply chain pivot to downstream applications. A coordinated malware campaign has compromised the JetBrains Marketplace with at least 15 malicious plugins, each posing as AI coding assistants built on DeepSeek and competing LLM providers. This represents a critical supply chain vulnerability exploiting developer trust in the IDE ecosystem. From an attacker's perspective, this campaign is textbook brilliant: developers install these plugins voluntarily, grant IDE-level permissions automatically, and the malware operates within trusted processes. The payload exfiltrates AI API keys OpenAI, Anthropic, Claude, Gemini , captures chatbot session transcripts, and potentially establishes persistence for post-exploitation. The attack leverages Shadow AI Exploitation https://dev.to/blog/shadow-ai-exploitation-ciso-governance-gap-2026/ blind spots - organizations don't control developer tool selection or monitor what extensions are installed in local IDEs. The malicious plugins use DeepSeek branding and legitimate feature descriptions to bypass manual review. This exploits several psychological vulnerabilities: Developer Blind Trust in IDE Marketplaces - Unlike app stores with reputation systems, JetBrains Marketplace has inconsistent vetting. Developers assume marketplace curation prevents malicious content. Legitimate Feature Set - Plugins advertise real functionality chat, commit messages, code review, unit tests that developers genuinely want. The malware is parasitic, not obvious. Supply Chain Authority - JetBrains' official marketplace position creates false legitimacy. Users don't validate plugin publisher identity or update history. This maps to MITRE ATT&CK T1195 Supply Chain Compromise https://attack.mitre.org/techniques/T1195/ with subclass T1195.001 Compromise Software Repository . The campaign likely targets the marketplace as the software repository, not downstream consumers. Once installed, plugins execute with IDE process privileges and access to developer's local environment: API Key Exfiltration - IDE configurations typically store API keys in plaintext or weakly encrypted formats. OpenAI keys, Anthropic credentials, Google Gemini tokens live in .env files, config files, or environment variables. A plugin can enumerate and exfiltrate in seconds. LLM Chat Session Capture - Chrome extension variant captures chatbot conversations in transit. Credentials transmitted in HTTP headers or request bodies become accessible. This captures proprietary code reviewed with AI assistants, internal architecture discussions, and sensitive prompts. Local File System Access - IDE plugins have filesystem read access. Attackers can harvest source code, git configs with credentials, private SSH keys, and Kubernetes manifests increasingly common in dev environments . This is T1555 Credentials from Password Stores https://attack.mitre.org/techniques/T1555/ combined with T1056.004 Capture Clipboard Data https://attack.mitre.org/techniques/T1056/004/ . The Chrome extension variant adds T1087 Account Discovery https://attack.mitre.org/techniques/T1087/ against cloud provider authentication states. Malicious plugins require command and control C2 for credential transmission. Attack flow: Plugin installed locally | v IDE process loads plugin at startup | v Plugin enumerates API keys from: - ~/.config/ /api keys - Environment variables - .env files in open projects - Browser localStorage via extensions | v Credentials packaged with metadata: - Developer username - Project paths - Git remote URLs - IDE plugins list | v HTTPS exfiltration to attacker C2 | v API keys tested immediately - OpenAI: query usage/balance - Anthropic: rate limit probing - Gemini: auth validation Once credentials are validated, attackers can: JetBrains plugins are packaged as ZIP files containing plugin.xml manifest and compiled code. Malicious variants have: