Blockchain security firm SlowMist has issued a detailed warning about malicious activity in the Solidity Pro Visual Studio Code extension, a tool marketed to Solidity and Web3 developers for features including gas queries, token price monitoring, code snippets, and compilation assistance.
According to the firm’s analysis published on August 19, 2026, historical versions of the extension under two publisher identities contained clear credential-harvesting, remote payload execution, and remote update capabilities designed to compromise developer machines.
The extension, available at times on Open VSX and linked to GitHub repositories, presented itself as a legitimate development aid that even referenced AI auditing and security scanning capabilities.
SlowMist’s investigation, based on static analysis of version history, build artifacts, and publisher changes without executing the samples, revealed a pattern of evolving malicious functionality followed by apparent cleanup in later releases. The two primary Extension IDs involved were helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Open VSX added both to its malicious extension control list on August 6–7, 2026.
Historical Versions Showed Credential Theft and Remote Execution
Under the helper-beeps publisher, version 2.4.1 activated in Solidity files or Hardhat/Foundry workspaces and introduced a deliberate delay of 24 to 48 hours before proceeding. After the wait, it checked for continuous-integration environment variables such as CI, GITHUB_ACTIONS, or JENKINS_HOME and exited if any were present—behavior consistent with attempts to evade automated analysis. It then requested encrypted data from remote “/firmware” endpoints, decrypted the response using AES-GCM, wrote the result as a temporary Python file, and launched it in detached mode via Node.js child_process.spawn so the payload could continue running even after the extension host closed.
Version 3.4.0 under the web3devtoolsx publisher shifted to more immediate data collection. It activated automatically on VS Code startup or when Solidity files were present.
The Web3Analytics module, enabled by default, scanned for a wide range of sensitive material: EVM private keys and BIP39 mnemonics, browser wallet vaults (MetaMask, Phantom, Rabby, Coinbase, and others), GitHub, and GitLab tokens, AWS and other cloud credentials, SSH private keys, .env files, OpenAI and similar API keys, and Telegram bot tokens.
The security firm noted that collected data was exfiltrated via HTTPS POST requests to obfuscated Cloudflare Workers endpoints on paths /x (JSON) and /y (multipart). In parallel, an AutoUpdater component polled remote servers every 30 minutes for new VSIX packages and installed them without hash, signature, or integrity checks, giving attackers an ongoing remote control channel.
Independent reporting from Yeeth Security and outlets including The Hacker News corroborated the presence of these capabilities across versions spanning roughly 1.0.0 to 3.x, noting the use of randomized delays, intermediate clean-looking releases to build trust, and exfiltration sometimes routed through Telegram in related samples.
Read: Stay Ahead of Scams: Top 5 Crypto Investigators You Must Follow
Publisher Changes and Clean Releases Highlight Detection Gaps
SlowMist traced a clear engineering lineage: build artifacts under the newer web3devtoolsx identity retained residual metadata, copyright notices, and repository references from helper-beeps. A later “Clean release” commit (labeled v1.0.0 / corresponding to the examined 4.0.0 bundle) produced a package containing only ordinary features such as gas tracking and price monitoring.
However, the GitHub source tree still contained the full malicious TypeScript modules for Web3Analytics and AutoUpdater. These were simply excluded from the final VSIX by .vscodeignore rules and by removing their imports from the main entry point. The result was a deliverable that appeared clean while the malicious code remained available for potential reintroduction.
This pattern underscores a critical limitation in current extension security practices. Scanning only the latest published version can allow an extension with a documented malicious history to reappear as low-risk after a cleanup.
SlowMist emphasizes that effective assessment must incorporate full version history, publisher identity changes, build provenance, residual source code, and any remote update mechanisms.
Developers who installed Solidity Pro, particularly versions associated with helper-beeps or web3devtoolsx, are advised to remove the extension immediately, rotate any potentially exposed credentials, wallets, and tokens, and audit local systems for unauthorized processes or files. Marketplace metrics, such as download counts or stars, should be treated only as contextual signals, never as security guarantees.
The incident reinforces the need for broader supply-chain scrutiny of IDE extensions that operate inside a developer’s highly privileged trust domain.
Also read: Block and Galaxy Research Give Lead to Law Enforcement in $112M Coldcard Bitcoin Theft
