Future TechnologyA Fake VS Code Extension Was Quietly Draining Developer Wallets
Key takeaways
- A VS Code extension called Solidity Pro was found stealing browser wallet credentials, API keys and other sensitive data
- It targeted developers working on smart contracts, a group likely to have valuable crypto wallets and credentials on the same machine
- Editor extensions run with broad access to your files and often your browser data, and marketplace review does not catch everything
- Auditing installed extensions periodically and limiting them to ones from verified publishers reduces the risk
Developer tools are a soft target because developers trust them by default. An extension called Solidity Pro, aimed at people writing Ethereum smart contracts, turned out to be exactly the kind of trap that works precisely because of that trust. Once installed in Visual Studio Code, it quietly harvested browser wallet credentials, API keys and other sensitive data from the machines it landed on.
Why developers specifically
Targeting Solidity developers is not random. Anyone writing smart contracts for a living is more likely than average to have a cryptocurrency wallet, exchange API keys and blockchain-related credentials sitting on the same laptop they code on. A malicious extension does not need to break into anything separately, it just needs to read what is already there. Editor extensions typically run with wide access to your file system and can interact with browser data too, which makes them a far more capable attack surface than most people realise when they click install.
Why it matters
Marketplace review processes catch a lot, but not everything, and malicious extensions have a track record of sitting undetected for weeks or months before anyone notices the pattern. If you install editor extensions regularly, it is worth an occasional audit: check who published each one, how long it has existed, and whether it still needs the permissions it asked for. Remove anything you do not actively use. It is the same instinct behind auditing browser extensions, just applied to the tool you spend your working day inside.
Sources and further reading below.