Malicious VS Code Extension “Solidity Pro” Hits Crypto Developers With Hidden Python Malware

Yeeth Security researchers identified a malicious Visual Studio Code extension named 'Solidity Pro' that targets cryptocurrency developers with a multi-stage attack, ultimately running independent Python malware on victims' machines. The extension, published as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, waits 12 to 72 hours before contacting Cloudflare Worker endpoints and launching a detached Python payload that persists even after closing the editor. The campaign resembles previously documented WhiteCobra activity but appears technically distinct.

Cryptocurrency developers who rely on Visual Studio Code for smart contract work now have a new threat to watch for. A malicious https://www.kobaran.com/tag/Malicious VS Code extension called “Solidity Pro” has been caught running a multi-stage attack that starts as a normal-looking coding tool and ends with independent Python malware operating on the victim’s machine, long after the editor itself has been closed. Security researchers at Yeeth Security identified the campaign after tracking two published packages, helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, both marketed as productivity tools for Solidity developers. On the surface, the extensions promise Solidity development support, AI-powered auditing, and gas-analysis features that would appeal to blockchain engineers working on smart contracts. Instead of delivering those features honestly, the extensions quietly download additional payloads, harvest sensitive developer data, and transmit it to servers controlled by the attackers. Because the malicious extension has already been indexed and installed by real users, the discovery is significant for anyone who develops in the Solidity ecosystem, and it adds to a growing list of supply-chain attacks aimed squarely at crypto developers. Why This Malicious Campaign Matters Right Now Attacks that use a malicious extension to compromise a trusted development environment are especially dangerous because they exploit a level of trust developers rarely question. VS Code extensions run with the same privileges as the editor itself, giving attackers a foothold that can extend well beyond the coding session. A Familiar Pattern With New Technical Details Researchers note that the campaign’s tradecraft resembles the previously documented WhiteCobra activity, which used fake Solidity-themed extensions and marketplace manipulation to target users of VS Code, Cursor, and Open VSX. That said, Yeeth Security is being careful about attribution. The samples behind Solidity Pro are technically distinct from earlier WhiteCobra tooling, so while the playbook looks familiar, this appears to be a separate or evolved operation rather than a confirmed continuation of the same group’s work. How the Malicious Extension Escapes the Editor The earliest versions of Solidity Pro, spanning v1.0.0 through v2.4.x, include components with innocuous-sounding names like Web3Analytics and ApiClient. Once installed, the extension does not act immediately. It waits for a randomized delay of anywhere from 12 to 72 hours, a deliberate tactic designed to slip past automated marketplace security scans and short-lived sandbox testing environments. After that delay passes, the extension reaches out to Cloudflare Worker endpoints that it assembles from encoded fragments rather than a single, easily detected URL. Some versions add a layer of camouflage by making a legitimate CoinGecko API call as a decoy while the real communication with command-and-control infrastructure happens in the background. The command-and-control server responds with a payload encrypted using AES-GCM. The extension then derives a decryption key from a passphrase hard-coded into the extension itself, writes the decrypted content out as a temporary Python file, and launches it using Node.js’s child process.spawn function. The most consequential technical detail is that this spawned process is detached. That means the Python payload keeps running independently of the VS Code extension host, so closing the editor or even uninstalling the extension does not stop the malware once it has been launched. Where the Payload Hides Depending on the version, the malicious file is saved under different names and locations to reduce the chance of detection. Some samples store it as a file resembling .vscode sol analytics .py inside the system’s temporary directory, while others place a randomly named file directly in the user’s home directory. Built-In Evasion Checks Before the malware runs, it checks the system for environment variables commonly associated with automated analysis and continuous integration platforms, including CI, GITHUB ACTIONS, JENKINS HOME, and GITPOD WORKSPACE ID. If any of these are detected, the malicious payload may choose not to execute, a behavior consistent with a broader trend among malicious VS Code extensions that are built to trigger on startup while avoiding detection in automated testing pipelines. From Simple Dropper to Full Infostealer The threat has escalated over time. According to Yeeth Security researchers, starting with version 3.1.0, the malicious extension shifted from being a basic Python dropper into a far more capable credential and cryptocurrency infostealer. Newer builds actively search for and collect data from browser profiles, local cryptocurrency wallet files, SSH keys, cloud service credentials, source-control access tokens, API keys, and Telegram bot tokens. That range of targets suggests the operators behind the malicious campaign are interested in far more than just crypto wallets. They appear to be after any credential that could provide broader access to a developer’s accounts, infrastructure, and codebases. Indicators of Compromise Security teams and developers who want to check their own environments for exposure can reference the indicators identified so far. | IOC Type | Indicator | Notes | |---|---|---| | Malicious extension | helper-beeps.solidity-pro | Core malicious Solidity Pro extension family | | Malicious extension | helper-beeps.solidity-pro-ai-auditor | Related Solidity-themed package | Researchers have intentionally defanged any associated IP addresses and domains in their published reporting, replacing characters with bracketed notation such as . to prevent accidental resolution or hyperlinking. Security teams should only re-fang these indicators within controlled threat intelligence environments such as MISP, VirusTotal, or an internal SIEM, rather than pasting them directly into a browser. What Developers Should Do Given the detached nature of the payload, simply removing the malicious extension is not enough to guarantee a clean system. Developers who have installed Solidity Pro, or any unfamiliar Solidity-themed extension, should treat the machine as potentially compromised. Recommended steps include: - Reviewing installed VS Code extensions for helper-beeps.solidity-pro, helper-beeps.solidity-pro-ai-auditor, or web3devtoolsx.solidity-pro - Checking temporary directories and the home folder for unfamiliar Python files, including anything resembling .vscode sol analytics .py - Rotating SSH keys, API keys, cloud credentials, source-control tokens, and Telegram bot tokens if the extension was ever installed - Auditing running and scheduled processes for detached Python scripts that were not intentionally launched - Reporting suspicious extensions to the Visual Studio Code Marketplace and Open VSX so they can be reviewed and removed The Bigger Picture for Crypto Developers This is not an isolated incident. Trojanized Solidity extensions and other developer tooling aimed at the crypto and Web3 space have become a recurring attack vector, precisely because developers in this space often install niche, less-vetted extensions to speed up smart contract auditing and gas optimization work. Each new malicious campaign adds pressure on marketplace operators like Microsoft and the Open VSX project to strengthen vetting processes for publishers and packages before they reach end users. Until extension marketplaces close that gap, the responsibility largely falls on individual developers and security teams to verify publisher reputation, scrutinize permissions, and monitor for unusual behavior after installing any new tool, especially one advertising specialized blockchain or smart contract features.