A Russian blockchain developer lost $500, 000 in cryptocurrency after installing a malicious extension for his code editor, highlighting how criminals exploit open-source repositories to deceive developers. The developer had installed a seemingly legitimate Solidity extension from the Open VSX registry for his Cursor AI editor. With 54, 000 downloads and a higher search ranking than the authentic version, it appeared trustworthy. However, the malicious extension offered no syntax highlighting functionality. Instead, it secretly downloaded a PowerShell script from angelic[. ]su, which installed ScreenConnect remote access software. This backdoor gave attackers full control over the developer’s system. The attack started when the developer was searching for a Solidity syntax highlighter. The malware also installed several VBScript files that downloaded stealers from paste. ee. These tools gathered data from browsers, email clients, and crypto wallets, enabling attackers to steal passwords and cryptocurrency. A broader campaign targeting developers This incident is part of a wider campaign.

Researchers have identified similar malicious extensions like “solaibot, ” “among-eth, ” and “blankebesxstnion. ” Additionally, a malicious npm package named “solsafe” was found using the same tactic. The criminals constantly evolve their methods. After the initial fake extension was removed, they quickly released a new one with the same name as the legitimate package. By mimicking the username (juanbIanco versus juanblanco) and boosting downloads to two million, they aimed to trick developers again. The Open VSX ranking algorithm aids these criminals by boosting new packages in search results, allowing malicious software to outrank legitimate options. Attackers systematically exploit this vulnerability. These attacks specifically target blockchain developers, likely due to their access to valuable cryptocurrency. Experts urge developers to exercise extra caution when installing packages from open-source repositories.