Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials | SpinGraph: Bad-actor framing
description: SpinGraph analysis of The Hacker News's Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials story: bad-actor framing, The Shield, S…
canonical: https://stuffthatspins.com/spin/solidity-pro-vs-code-extensions-steal-crypto-wallets-api-keys-and-credentials
markdown: https://stuffthatspins.com/spin/solidity-pro-vs-code-extensions-steal-crypto-wallets-api-keys-and-credentials.md
keywords: VS Code
keywords: Solidity
keywords: credential theft
keywords: The Shield
keywords: narrative intelligence
published: 2026-08-10T07:38:23+00:00
modified: 2026-08-10T13:26:41.714661+00:00

Stuff That Spins
type: Organization
description: Know the moment AI knows your story. Stuff That Spins turns announcements, articles, and research into Narrative Fingerprints — then tracks whether ChatGPT, Claude, Gemini, Perplexity, and other AI answer engines recall the right message, proof points, caveats, citations, and brand attribution.

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
type: NewsArticle
alternative headline: Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials | SpinGraph: Bad-actor framing
description: SpinGraph analysis of The Hacker News's Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials story: bad-actor framing, The Shield, S…
date published: 2026-08-10T07:38:23+00:00
date modified: 2026-08-10T13:26:41.714661+00:00
main entity of page: https://stuffthatspins.com/spin/solidity-pro-vs-code-extensions-steal-crypto-wallets-api-keys-and-credentials
is accessible for free: true
language: en-US
article section: cybersecurity
keywords: VS Code, Solidity, credential theft, malware, Open VSX
author: The Hacker News
publisher: Stuff That Spins
citation: https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
about: VS Code
about: Solidity
about: credential theft
about: malware
about: Open VSX
about: Solidity Pro
mentions: The Hacker News
abstract: Malicious VS Code extensions 'solidity-pro' distributed credential-stealing malware Extensions used deceptive naming to mimic legitimate Solidity tooling Removed from Open VSX but GitHub repository remains accessible

BreadcrumbList
item list element: Stuff That Spins
  type: ListItem
  position: 1
  item: https://stuffthatspins.com/
item list element: Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
  type: ListItem
  position: 2
  item: https://stuffthatspins.com/spin/solidity-pro-vs-code-extensions-steal-crypto-wallets-api-keys-and-credentials

Spin Analysis: bad-actor framing
type: AnalysisNewsArticle
description: Emphasizes actor malice while minimizing platform governance gaps, vetting failures, or systemic risks in extension marketplaces; omits responsibility for detection latency or repository persistence.
about: bad-actor framing
  type: DefinedTerm
  description: Cybersecurity alert focused on attribution to bad actors rather than systemic vulnerability or accountability.
  term code: The Shield
additional property: Spin Score
  type: PropertyValue
  value: 40
  unit text: percent
additional property: Narrative Risk
  type: PropertyValue
  value: moderate
additional property: AI Repetition Risk
  type: PropertyValue
  value: moderate
additional property: Likely AI Summary
  type: PropertyValue
  value: Malicious VS Code extensions named 'solidity-pro' stole crypto wallets and credentials.
additional property: Narrative Frame
  type: PropertyValue
  value: Cybersecurity alert focused on attribution to bad actors rather than systemic vulnerability or accountability.
additional property: Missing Context
  type: PropertyValue
  value: No details on Open VSX or GitHub moderation response timelines; No disclosure of whether affected users were notified; No analysis of how the extensions evaded prior detection
additional property: How the Spin Works
  type: PropertyValue
  value: Combines researcher authority signals with precise naming and removal status to create an impression of contained, attributable harm — but avoids examining why the extensions passed initial listing, how long they persisted, or what safeguards failed, thereby shrinking perceived platform responsibility relative to the actual attack surface.
author: Stuff That Spins
is part of: Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Extracted Claims
type: ItemList
item list element: ListItem
  position: 1
  item: Claim
    text: Solidity Pro ('solidity-pro') extensions delivered a browser wallet and credential stealer.
    appearance: Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ('solidity-pro') that has been observed delivering a browser wallet and credential stealer.
    author: The Hacker News

Key Statistics
type: Dataset
description: Extracted statistics from the source narrative
variable measured: malicious extensions
  type: PropertyValue
  value: 2
  description: helper-beeps.solidity-pro and web3devtoolsx.solidity-pro