|

Beware of Solidity Pro: A Targeted Poisoning Attack on Web3 Developers

Credential harvesting mechanically triggered after VS Code startup, /x and /y exfiltration, and an independently operating distant VSIX replace channel.

III. Publisher Migration

Solidity Pro 2.4.1 and three.4.0 don’t belong to the identical Extension ID. The former was printed by helper-beeps, whereas the latter used the brand new writer web3devtoolsx. So why can they nonetheless be positioned on the identical investigative observe?

The inner metadata of the preliminary v3.4.0 commit fe794a2 straight solutions this query. The bundle.json declares writer: web3devtoolsx, model 3.4.0, with the repository pointing to github.com/web3devtoolsx/solidity-pro. Meanwhile, the out/bundle.json from the identical commit nonetheless retains writer: helper-beeps, model 3.3.0, with the repository pointing to github.com/helper-beeps/solidity-pro. The LICENSE file nonetheless states “Copyright (c) 2026 Helper Beeps”.

The two bundle.json information got here from the identical commit, proving that the preliminary construct artifact underneath the web3devtoolsx id got here straight from the helper-beeps venture, establishing a direct supply relationship between the code or construct artifacts.

When the inheritance relationship between the construct artifacts is overlaid with the timeline of official malicious markings, the sample of writer rotation turns into clearer:

helper-beeps.solidity-pro added to the official malicious listing (2026-08-06 14:27:24 UTC)
        │ 8 hours 32 minutes 48 seconds
        ▼
web3devtoolsx GitHub account created (2026-08-06 23:00:12 UTC)
        │ roughly 16 minutes
        ▼
New Solidity Pro v3.4.0 seems
        │ the next day
        ▼
web3devtoolsx.solidity-pro additionally added to the official malicious listing (2026-08-07 12:38:52 UTC)
The previous writer, model, repository URL, and copyright remnants within the preliminary commit show a direct supply relationship between the construct artifacts.

IV. Clean Release

Just 13 minutes and 29 seconds after the malicious v3.4.0 bundle was dedicated within the preliminary GitHub commit, the identical repository dedicated a Clean commit that reverted the model to v1.0.0. During this extraordinarily brief window, the writer additionally briefly initiated after which closed an Open VSX namespace declare (the difficulty acquired no feedback and was closed by web3devtoolsx itself).

The modifications within the Clean commit had been exactly concentrated on two varieties of targets. On the execution facet, it eliminated Web3Analytics activation, AutoUpdater startup, the telemetry configuration, the javascript-obfuscator dependency, and the obfuscated construct steps. On the product floor, it eliminated the AI Audit Engine, Security Scanner, the 100K+ badge, and exaggerated functionality claims. The model quantity was reverted from 3.4.0 to 1.0.0.

These modifications had been concentrated in a single commit named “Clean launch”. It straight eliminated publicly reachable high-risk entry factors and a few conspicuous advertising and marketing copy, stopping techniques that solely examine the brand new bundle from detecting the unique malicious modules. The cleanup was not full: the “Trusted by 100K+” and “vulnerability scanner” descriptions within the bundle.json weren’t eliminated—essentially the most conspicuous badge was deleted, however metadata that would have an effect on search outcomes and the shop web page would stay if this manifest had been really packaged and printed. As talked about above, the malicious supply code additionally remained intact within the src/ listing and was merely excluded from the ultimate bundle by way of .vscodeignore.

The Clean launch modified the ultimate deliverable, not the historical past that had already occurred throughout the venture.

V. Credibility Packaging

Almost concurrently with the model modifications, the brand new publishing id was quickly given a credibility-oriented look: inside roughly 16 minutes after the web3devtoolsx account was created, an enterprise-style profile, six well-known venture forks, a product repository, a mature model quantity, and a 100K+ declare appeared in succession. The focus of these indicators would objectively make the brand new account seem extra like a longtime group.

Enterprise-style profile. About quarter-hour after the account was created, the Profile already included the title “Web3 Dev Tools”, an organization subject, a location in Zug, an official web site, a Twitter hyperlink, one launched product, and a roadmap for 2 “Coming Q3” merchandise. As of the evaluate performed on August 12, 2026, long-term exercise indicators similar to followers, following, and gists remained at 0.

Six well-known venture forks. Within 13 seconds, the account consecutively forked OpenZeppelin Contracts, Foundry, Hardhat, Chainlink, Uniswap v3-core, and ethers.js. An bizarre customer would see acquainted Web3 venture names on the profile, however a fork solely signifies that an upstream repository was copied; it doesn’t symbolize a contribution, collaboration, or any type of endorsement.

Version tags inconsistent with the creation time. The preliminary commit, made simply 8 seconds after the repository was created, concurrently carried 5 units of model tags: v2.4.1, v2.4.5, v3.2.3, v3.3.0, and v3.4.0. The supply headers additionally claimed that the venture was first launched in 2025. These model and age indicators are clearly inconsistent with the general public historical past displaying that the account and repository had solely simply been created that day.

Repeated reinforcement of social proof. “100K+” appeared concurrently within the repository description, bundle.json, out/bundle.json, README badge, README physique, and construct output, making it a repeatedly emphasised user-count declare throughout the venture’s public supplies. The out there proof can not independently confirm the authenticity of this determine, however just like the mature model numbers, enterprise-style Profile, and forks of well-known tasks, this declare collectively contributes to the mature product picture that Solidity Pro presents externally.

These promotional claims are in clear battle with the precise code habits confirmed above: the README claims that personal keys or supply code aren’t saved, the configuration describes telemetry as nameless utilization knowledge, and the construct script refers back to the obfuscation course of utilizing javascript-obfuscator as “privateness”. The product claims AI auditing, vulnerability scanning, and reentrancy detection, however the public instructions primarily question Gas, show token costs, and supply a immediate for compilation by way of Hardhat/Foundry.

Organizational data, well-known forks, mature model numbers, 100K+, genuinely usable fundamental options, and privateness statements can all affect a customer’s preliminary evaluation of the extension. Each factor might seem regular when considered individually; the anomaly lies in the truth that these indicators appeared alongside malicious code, a speedy timeline, and construct remnants from the previous writer.

VI. Blind Spots of Single-Version Detection

Malicious code could be eliminated, however model historical past, publishing identities, and engineering provenance don’t mechanically disappear.

Taken collectively, the findings from the primary 5 sections reveal a sample in Solidity Pro that deserves consideration from platforms and safety merchandise: an extension title and writer already related to a transparent historical past of malicious exercise can launch a brand new model that not comprises the unique malicious capabilities, inflicting detection techniques that examine solely the present construct to return clear, no-hit, or low-risk outcomes once more.

Distinguishing this sample from a traditional safety repair can not rely solely on whether or not the brand new code is clear. Four layers of questions must be checked concurrently:

  • Hashes and the present bundle reply: What does this file include now?
  • Version historical past solutions: What has this Extension ID or writer delivered beforehand?
  • Publisher and code provenance reply: Which identified malicious tasks have a direct relationship with the present bundle?
  • Current and historic distant management planes reply: Does the present native code or any historic model enable a server to change the delivered content material?

For extension marketplaces and safety merchandise, this implies the detection scope must broaden from a “single file hash” to model historical past, writer modifications, construct artifact variations, and distant management planes:

  • Preserve hashes and deobfuscation outcomes for historic variations; when a brand new model removes a big quantity of harmful modules, set off a differential evaluate reasonably than mechanically restoring its status.
  • Correlate remnants of previous publishers, code similarity, and construct scripts to ascertain provenance relationships between code or construct artifacts.
  • Include periodic /model checks, distant URLs, and short-term VSIX set up data in runtime monitoring.
  • Treat obtain counts, stars, and enterprise-style Profiles solely as contextual data, not as safety endorsements.

Conclusion

Solidity Pro contained clearly malicious implementations underneath each the helper-beeps and web3devtoolsx publishing identities: 2.4.1 used native randomized delays and surroundings filtering as conditions earlier than downloading and executing encrypted Python from a distant server; 3.4.0 mechanically triggered credential harvesting after VS Code startup, exfiltrated the info by way of the /x and /y HTTP request paths, and retained a VSIX replace channel pushed by distant responses. The out/bundle.json, repository, and copyright data within the preliminary 3.4.0 construct nonetheless pointed to helper-beeps, proving a direct supply relationship between the construct artifacts underneath the 2 publishing identities.

The remaining bundle within the GitHub Clean commit eliminated these malicious modules, however the repository nonetheless retained their supply code; the regionally rebuilt 4.0.0 bundle likewise confirmed no traces of the unique malicious modules. The preliminary commit containing the malicious 3.4.0 entry factors and construct artifacts was solely 13 minutes and 29 seconds other than the Clean commit, whereas the enterprise-style profile, six well-known forks, product repository, and mature model claims appeared inside roughly 16 minutes after the account was created.

This case in the end demonstrates that assessing extension threat primarily based solely on the present file or present model is much from enough. Malicious code can disappear from the most recent bundle, however the historical past of malicious exercise doesn’t grow to be invalid consequently — a clear new model can not erase the truth that the identical title and writer beforehand delivered malicious code.

Recommendations

1. Developers who’ve put in helper-beeps.solidity-pro or web3devtoolsx.solidity-pro ought to first isolate the community, protect the extension listing, set up bundle copies, processes, and community logs, after which disable and uninstall the related variations. Subsequently, examine the VS Code course of tree, Python information in short-term directories, anomalous VSIX set up data, and proxy logs for /firmware, /x, /y, and /model requests.

2. If Solidity Pro 3.4.0 (writer: web3devtoolsx) was ever enabled and run, pockets non-public keys, mnemonic phrases, GitHub/GitLab/npm/PyPI/AWS/Cloudflare/AI service credentials, and CI/CD tokens might have been uncovered. Related credentials must be revoked or rotated from a clear machine as a precedence; crypto belongings must be migrated to wallets utilizing a very new seed or non-public key. Simply altering the password of the unique pockets will not be enough.

3. If Solidity Pro 2.4.1 (writer: helper-beeps) was ever enabled and run, so long as the host might have remained lively past the pattern’s delay window, or the precise runtime period can’t be confirmed, the incident must be investigated as a possible native code execution occasion.

4. Enterprise safety groups ought to first seek for Extension IDs, harmful request paths, identified Workers, short-term information, and anomalous course of timber, then decide the scope of affect by correlating the SHA-256 hashes of the 2 samples, extension set up occasions, and community data from VS Code processes. Particular consideration must be paid to mixtures of behaviors such because the VS Code Extension Host launching indifferent Python processes, putting in VSIX packages from short-term paths, and studying high-value configuration information earlier than initiating multipart HTTPS requests.

5. Extension marketplaces ought to require obligatory handbook evaluate when default telemetry consists of credential entry, distant downloading, decryption and execution, or set up of VSIX packages outdoors official channels. Historical variations must be retained and subjected to cross-version differential evaluate to stop later variations that not set off malicious-code detection from mechanically clearing the danger labels related to earlier variations.

IOC

Malicious Files

filename: helper-beeps.solidity-pro-2.4.1.tar.gz
SHA256: 7b53b1d93f46babc7415d898e17e71ffb6f3a3af3adb222f21c03adea8b30d50

filename: web3devtoolsx.solidity-pro-3.4.0.gz
SHA256: bcbaf774f9cea0b0131859b96ba0eeadfd5a49bba59302de1bcf3d884300d508

About MistEye

MistEye is a Web3 menace intelligence and dynamic safety monitoring platform independently developed by SlowMist. Through its API, it supplies malicious exercise detection and provide chain threat alerting for the open-source bundle ecosystem.

All malicious packages and IOCs concerned on this operation have been built-in into the MistEye menace detection engine. Developers can use the API to mechanically scan venture dependencies, shortly decide whether or not they match identified malicious packages, and acquire really useful remediation actions.

📖 API Documentation: https://app.misteye.io/api-docs

🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan
A light-weight CLI instrument that scans venture dependencies and globally put in packages for identified malicious packages with a single command. It helps the npm / PyPI / Rust (Cargo) / Go / RubyGems ecosystems.

🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills
Security abilities for AI coding assistants that mechanically set off MistEye safety checks earlier than dependency set up and URL entry.

🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard
A regionally applied DNS relay written in Rust that detects malicious domains and dangerous entry, figuring out community threats similar to phishing and C2.

This article was written by the SlowMist Threat Intelligence Team primarily based on the MistEye menace intelligence platform and SlowMist Agent AI-driven evaluation. If you’ve gotten any questions, please be at liberty to contact us for session and suggestions.

References

[1] https://yeethsecurity.com/weblog/2026-08-06-Solidity-Pro-WhiteCobra-C2-to-Telegram

About SlowMist

SlowMist is a menace intelligence agency centered on blockchain safety, established in January 2018. The agency was began by a group with over ten years of community safety expertise to grow to be a worldwide power. Our objective is to make the blockchain ecosystem as safe as doable for everybody. We at the moment are a famend worldwide blockchain safety agency that has labored on numerous well-known tasks similar to HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and so forth.

SlowMist provides a spread of companies that embrace however aren’t restricted to safety audits, menace data, protection deployment, safety consultants, and different security-related companies. We additionally provide AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide corporations similar to Akamai, BitDefender, RC², TianJi Partners, IPIP, and so forth. Our intensive work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a complete safety resolution personalized to particular person tasks, we will determine dangers and forestall them from occurring. Our group was capable of finding and publish a number of high-risk blockchain safety flaws. By doing so, we might unfold consciousness and lift the safety requirements within the blockchain ecosystem.

Similar Posts