Security monitoring firm GoPlus has issued a critical warning regarding a poisoned Visual Studio Code (VSCode) extension titled Solidity Pro. According to the alert released on August 19, 2026, historical versions of this tool were found to contain malicious capabilities designed for data exfiltration and remote code execution. The extension specifically targeted Web3 developers working on smart contracts, leveraging the trust associated with developer tooling to infiltrate local environments and compromise sensitive assets.
Mechanism of the Supply Chain Attack
The investigation into Solidity Pro (identified by publisher IDs such as helper-beeps and web3devtoolsx) revealed a sophisticated multi-stage infection process. Early iterations of the extension, specifically versions 1.0.0 through 2.4.x, acted as "droppers", beaconing to Cloudflare Workers endpoints to retrieve and execute encrypted Python payloads. Later releases, starting from version 3.0.0, evolved into full-scale information stealers capable of harvesting a wide range of developer secrets.
- Cryptocurrency Wallets: Extraction of seed phrases and private keys from MetaMask, Phantom, Rabby, Coinbase, and Keplr.
- Authentication Tokens: Theft of GitHub (ghp_), GitLab, and OpenAI API keys.
- Cloud Credentials: Compromise of AWS session tokens and Cloudflare access keys.
- Communication Data: Exfiltration of Telegram bot tokens and session information.
Evasion and Persistence Tactics
To bypass automated security scans and marketplace reviews, the attackers utilized delayed activation strategies, often waiting between 12 and 72 hours before executing malicious code. Some versions even included "decoy" features like gas trackers or price monitors to establish a veneer of legitimacy. This technique ensures that the extension appears benign during the initial installation phase, only triggering the malicious branch once the user has integrated the tool into their workflow.
By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on.
Recommendations for Developers
Security experts advise all developers who have interacted with Solidity-themed extensions to immediately audit their installed plugins. If Solidity Pro is found, users should not only remove the extension but also assume their local environment is compromised.
Recommended actions include rotating all API keys, moving funds to new wallet addresses with fresh seed phrases, and checking for unauthorized background processes. The incident underscores a growing trend of targeting the Solidity ecosystem through supply chain vulnerabilities, following similar attacks involving hijacked publisher accounts and typosquatting on the Open VSX registry.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.