🚨 DEVS GETTING RUGGED BY THEIR OWN TOOLS
Solidity Pro VSCode extension = trojan horse targeting Web3 devs
SlowMist found malicious code in old versions under publishers "helper-beeps" and "web3devtoolsx":
• Credential harvesting
• Remote payload execution
• Remote VSIX updates
The twist? Later versions scrubbed the malicious code clean. But the old publisher traces + malicious source still sitting in the repo.
The blind spot: Most security tools only scan current versions. If an extension had malware in v1.0 but looks clean in v2.0, it flies under the radar.
This isn't just about one extension. It's about supply chain attacks hitting devs where they live—their IDE.
If you're building in Web3, audit your extensions. Check version history. Check publisher changes. Don't trust "clean" at face value.
Your private keys are only as safe as your dev environment.
Solidity Pro VSCode extension = trojan horse targeting Web3 devs
SlowMist found malicious code in old versions under publishers "helper-beeps" and "web3devtoolsx":
• Credential harvesting
• Remote payload execution
• Remote VSIX updates
The twist? Later versions scrubbed the malicious code clean. But the old publisher traces + malicious source still sitting in the repo.
The blind spot: Most security tools only scan current versions. If an extension had malware in v1.0 but looks clean in v2.0, it flies under the radar.
This isn't just about one extension. It's about supply chain attacks hitting devs where they live—their IDE.
If you're building in Web3, audit your extensions. Check version history. Check publisher changes. Don't trust "clean" at face value.
Your private keys are only as safe as your dev environment.