A Solidity extension called “Solidity Pro” sounds like the kind of tooling every crypto developer installs without thinking. That is exactly why it keeps appearing in malware campaigns. Yeeth Security recently tracked two publishers, helper-beeps and web3devtoolsx, shipping versions of a solidity-pro extension that evolved from a delayed Cloudflare-Worker dropper into a full browser-wallet and credential infostealer. The progression mirrors what public reporting has attributed to the WhiteCobra group, whose leaked “Operation Solidity Pro” playbook described a five-phase campaign targeting VS Code: and Open VSX users.

Executive Summary

  • helper-beeps.solidity-pro and web3devtoolsx.solidity-pro are the same malicious family packaged under different publishers.
  • Early versions (v1.0.0 through v2.4.x) beacon to Cloudflare Worker endpoints, download an AES-GCM encrypted Python payload, and execute it via child_process.spawn.
  • From v3.0.0 onward the family pivots to a wallet/credential infostealer that harvests browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens, then exfiltrates via Telegram bot uploads.
  • The campaign spans at least v1.0.0 through v4.0.0 with heavy obfuscation throughout, including decoy versions that contain no malicious code.
  • Yeeth Security previously covered the start of this activity in “WhiteCobra Beginnings”, an early sample that used a NomcFoundation.hardhat-solidity impersonation to install a backdoor via Optimizer.js. The new helper-beeps and web3devtoolsx packages are a later iteration of the same tradecraft: Solidity-themed tooling, fake publisher names, and a multi-stage payload delivered through the extension host. Public reporting from Koi Security later recovered a WhiteCobra deployment plan titled “DEPLOYMENT PLAN: Operation Solidity Pro” that describes the same fake-download inflation, social promotion, and rapid redeployment tactics.

Why the cover works

Developers searching Open VSX or the VS Code: Marketplace for Solidity tooling expect to see names that sound official: hardhat-solidity, solidity-ethereum, vscode-solidity. A publisher like helper-beeps or web3devtoolsx with a solidity-pro package blends into that list, especially when the extension ships a polished README and claims to offer AI-powered auditing or advanced gas tracking. The name “Solidity Pro” itself is close enough to legitimate tooling that a quick glance does not flag it.

Yeeth Security first described this behavior in “WhiteCobra Beginnings”: a malicious Solidity-themed extension on Open VSX that used fake download counts to look more legitimate than the real plugin and ultimately stole $500,000 from one developer. The current helper-beeps / web3devtoolsx samples continue that playbook. Public reporting from Koi Security later recovered a WhiteCobra deployment plan titled “DEPLOYMENT PLAN: Operation Solidity Pro” that reportedly instructs operators to upload packages with “convincing details,” inflate downloads to 50,000 or more for social proof, promote them on X with pre-written templates, and monitor stolen seed phrases in real time. The playbook lists ChainDevTools.solidity-pro among the targeted Open VSX extensions. Yeeth Security’s observed samples share the same branding and version churn tactics, though they are not byte-identical to the extensions named in that playbook.

Version-by-version evolution

The family is not a single static payload. It is a chassis that has been refactored repeatedly across more than twenty observed versions.

Era Versions Behavior
C2 dropper 1.0.0–2.4.x Beacon to Cloudflare Workers; download AES-GCM encrypted Python; drop and spawn .py payload.
Obfuscated dropper 2.4.7–2.4.8, impostor 2.4.7 Same skeleton with heavier obfuscation and varied staging paths.
Transition 3.0.0–3.0.2 Still contains Web3Analytics/ApiClient/ENDPOINTS primitives; obfuscated release files hide the v3 infostealer skeleton underneath.
Infostealer 3.1.x–3.2.x, web3devtoolsx 3.4.0 Telegram bot exfiltration of wallets, credentials, SSH keys, and browser data.
Decoy web3devtoolsx 1.0.0 / 4.0.0 Tiny, clean package with the same display name; likely reputation-building or takedown-response testing.

Early dropper versions

In v1.0.0 through v2.4.x, extension.js activates Web3Analytics and an ApiClient, waits a random bounded delay, and sends telemetry to a list of Cloudflare Worker URLs stored in CFG.ENDPOINTS. The endpoints are assembled from hex fragments. Decoded fragments include subdomains like violet-87cardo[.]workers[.]dev, cardo[.]workers[.]dev, and soft-feather-7807.0x.cloudflare-workers[.]workers[.]dev, plus a api[.]coingecko[.]com/api/v3/simple/ decoy request.

The server response is AES-GCM encrypted. The key is derived from a static passphrase via crypto.createHash('sha256') or crypto.pbkdf2Sync, with deobfuscated material referencing Ethereum wallet-signing phrases. The decrypted response is written to a temp .py file and executed with child_process.spawn, detached so it survives the extension host. Some versions place the file under os.tmpdir() as .vscode_sol_analytics_<timestamp>.py; others use os.homedir() with a random filename. The extension also checks for CI/sandbox environment variables (CI, GITHUB_ACTIONS, JENKINS_HOME, GITPOD_WORKSPACE_ID) before running the payload.

A representative reconstruction of the activation and scheduling logic:

const cfg = {
    ENDPOINTS: [
        buildEndpoint([0x76, 0x69, 0x6f, 0x6c, 0x65, 0x74, 0x2d, 0x38, 0x37, 0x63, 0x61, 0x72, 0x64, 0x6f, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x64, 0x65, 0x76]),
        buildEndpoint([0x73, 0x6f, 0x66, 0x74, 0x2d, 0x66, 0x65, 0x61, 0x74, 0x68, 0x65, 0x72, 0x2d, 0x37, 0x38, 0x2e, 0x30, 0x78, 0x2e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x66, 0x6c, 0x61, 0x72, 0x65, 0x2d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x64, 0x65, 0x76])
    ],
    MIN_DELAY_MS: 12 * 60 * 60 * 1000,
    MAX_DELAY_MS: 72 * 60 * 60 * 1000
};

v3 infostealer versions

From v3.1.0 onward, the configuration block changes shape. Instead of ENDPOINTS, the extension carries WORKERS, CID, MAX_FILES, MAX_VAULTS, MAX_FILE_SIZE, and MAX_REPORT_ENTRY. Decoded worker fragments include cold-peak-60871, steel-mere-orker, richardorichp, and 0x0gnx0 (all defanged). The exfiltration channel is Telegram: multipart/form-data uploads to a bot endpoint using chat_id, parse_mode, and a /u upload path.

The credential target list is broad:

  • GitHub ghp_ / github_pat_ tokens
  • GitLab glpat- tokens
  • AWS keys and session tokens
  • Cloudflare cfat_ tokens
  • OpenAI sk- / sk-proj- / sk-ant- keys
  • Telegram bot tokens
  • Mnemonic/seed phrases
  • Wallet vaults: MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr
  • Bitcoin WIF / xprv
  • SSH private keys (PRIVATE KEY)
  • URL credentials and 1Password mfa. tokens

This is not a generic clipboard scraper. It is a structured asset harvester aimed at the exact files and strings a developer accumulates while working in web3.

Decoy versions

The web3devtoolsx publisher also shipped 1.0.0 and 4.0.0 packages that are tiny, clean, and share the same displayName and README claims. They contain ApiClient, Logger, GasTracker, and PriceMonitor but no Web3Analytics, WORKERS, CID, credential strings, or staging primitives. These are likely used to build publisher reputation or to test how quickly a benign upload is approved after a malicious version is removed.

Why this evades detection

The family is built to survive marketplace review, static scanning, and casual sandboxing at the same time.

Defender assumption What the extension does instead
Malware runs immediately after install It waits a randomized multi-hour or multi-day delay before any malicious code runs.
The main extension.js is the whole story Heavy obfuscation, hex-encoded fragments, and eval-based secondary scripts hide the real behavior.
Crypto stealers only target clipboard or wallet extensions Later versions walk the filesystem for vault directories, SSH keys, and API tokens.
One publisher equals one threat The same skeleton rotates between helper-beeps, web3devtoolsx, and an iktok90-design impostor.
Clean versions mean the publisher is safe Interleaved decoy versions (1.0.0, 4.0.0) dilute the signal between malicious and benign uploads.

The delayed-activation gate is especially effective. By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on. The obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target.

Connection to the WhiteCobra campaign

Yeeth Security’s first public look at this actor came in September 2025 with “WhiteCobra Beginnings,” a NomcFoundation.hardhat-solidity sample that gathered system telemetry, used an XOR-encrypted C2 domain, and injected shellcode via werfault.exe. The same building blocks show up again here: a Solidity-themed extension on Open VSX, an impersonation publisher, encrypted C2 traffic, and a payload that runs outside the extension host.

Public reporting from Koi Security later recovered a WhiteCobra deployment plan titled “DEPLOYMENT PLAN: Operation Solidity Pro.” The playbook reportedly outlined a five-phase strategy: packaging, deployment to Open VSX with convincing details, social-media promotion, automated download inflation, and real-time exfiltration. The extension list in that report includes ChainDevTools.solidity-pro on Open VSX. Yeeth Security’s helper-beeps.solidity-pro and web3devtoolsx.solidity-pro samples are technically distinct artifacts, but they share the same display name, target audience, publisher-churn behavior, and rapid version iteration described in the playbook.

The Koi article also described a multi-stage delivery chain: a minimal extension.js calling a prompt.js utility that uses eval on base64 content to download a platform-specific payload, eventually installing LummaStealer. Yeeth Security’s observed helper-beeps versions do not use that exact chain; instead they embed the malicious logic directly inside extension.js and stage either a Python dropper or an embedded infostealer. The overlap is in the operational playbook, not the byte-level payload. Treating this as WhiteCobra requires more than TTP overlap, but the parallels are consistent enough to note.

Recommendations

For individual developers:

  • Treat “Solidity Pro,” “Solidity AI Auditor,” and similar premium-sounding extension names as unverified until you confirm the publisher. The real Solidity tooling ecosystem is small; unfamiliar publishers with high download counts should be suspect.
  • Do not copy seed phrases or private keys into VS Code: or any extension host. Use a hardware wallet or a separate, non-clipboard secret flow.
  • Review installed extensions quarterly and remove anything you do not actively use.
  • For teams, use dev-guard or another registry-monitoring tool to receive live campaign updates.

For platform maintainers:

  • Download counts should not be treated as a trust signal without publisher verification. Automated inflation is documented in the WhiteCobra playbook and visible in this campaign.
  • Publisher-name similarity checks and repeated re-uploads of the same display name by new accounts are strong abuse signals worth prioritizing.

Indicators of Compromise

Malicious extension identifiers

  • helper-beeps.solidity-pro
  • helper-beeps.solidity-pro-ai-auditor
  • web3devtoolsx.solidity-pro
  • iktok90-design.solidity-pro (impostor)

Representative SHA-256 hashes (extension.js)

  • 0a9da2b33c94da3f1fc02502ab3caed6e1fbe40f9115422c09103c42a9f8b3d1 — helper-beeps 1.0.0
  • da38bd92ead5c3993cce5a940066dd226cbe4c1f3bbfafbeb91e093813479a89 — helper-beeps 2.4.1
  • b721113f3e747c38cda0e5a6a1de9b28bf64bd8391d291177a4d3eae5bf0bbc3 — helper-beeps 3.0.0
  • 20c2a806619e1f32b3adc78689366959089d1a5de17a59a924bf477284785b5f — helper-beeps 3.1.0
  • 740b461724784e04d6872824904c244016408b30cbbf6c89c069048df9321178 (truncated) — web3devtoolsx 3.4.0 infostealer

Network fragments

  • violet-87cardo[.]workers[.]dev
  • soft-feather-7807.0x.cloudflare-workers[.]workers[.]dev
  • cold-peak-60871 (subdomain fragment)
  • steel-mere-orker (subdomain fragment)
  • richardorichp (subdomain fragment)
  • 0x0gnx0 (subdomain fragment)

Behavioral coverage

  • Delayed activation with CI/sandbox environment checks.
  • AES-GCM decryption of a downloaded payload using a static passphrase.
  • Python staging via child_process.spawn.
  • Telegram bot uploads of wallet vaults, credentials, and SSH keys.

The helper-beeps / web3devtoolsx campaign shows that “Solidity Pro” is not a one-off idea. It is a reusable, evolving brand that moves from remote dropper to local infostealer and back again, always hiding behind the same developer-tooling disguise. Marketplace users have no reliable way to tell the real extension from the fake one by looking at the page, so detection has to follow the behavior instead.