What Happened
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-pro Although neither of the extensions is now available on Open VSX, the GitHub repository
Why It Matters
The article reports that a malicious VS Code extension, Solidity Pro, and related extensions were used to steal crypto wallet data, API keys, and other credentials from developers. The listed extension names include helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, and the report says the extensions were removed from Open VSX. From a RealGround perspective, this is a developer-tool supply chain incident with direct credential exposure risk, so affected environments should be treated as potentially compromised and reviewed for extension provenance, secrets exposure, and credential rotation.
RealGround Analysis
This signal maps to data leakage. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html