🟠 High | Source: The Hacker News
Two malicious Visual Studio Code extensions posing as Solidity development tools were found stealing cryptocurrency wallet data, API keys, and login credentials from developers. The extensions, published under ‘helper-beeps.solidity-pro’ and ‘web3devtoolsx.solidity-pro’, targeted Web3 and blockchain developers who installed them via the Open VSX marketplace. Although now removed, any developer who installed either extension should treat their credentials and wallets as compromised.
Security Architect’s Take: Audit developer workstations and CI/CD pipelines for the presence of these extensions immediately, and enforce an approved VS Code extension allowlist via policy (e.g. VS Code Extension Marketplace restrictions or a curated internal mirror). Any API keys, cloud credentials, or wallet seed phrases accessible from affected developer machines should be rotated as a priority.
Original advisory: Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials