MALICIOUS WINDSURF IDE EXTENSION STEALS DEV CREDENTIALS VIA SOLANA; TIGHTEN IDE EXTENSION HYGIENE
A fake Windsurf R-language extension used the Solana blockchain to drop a NodeJS stealer that targets developer credentials. Bitdefender found a Windsurf exten...
A fake Windsurf R-language extension used the Solana blockchain to drop a NodeJS stealer that targets developer credentials.
Bitdefender found a Windsurf extension masquerading as R support for VS Code that decrypts after install, fetches payloads from Solana transactions, steals Chromium passwords and cookies, and persists via a hidden PowerShell task using a bundled NodeJS runtime (Bitdefender, KBI.Media, SecurityBrief). The sample name mimicked REditorSupport to trick developers.
Separate but relevant: VS Code 1.112 adds MCP server sandboxing and upgrades to agent/CLI flows, which can help reduce local agent and extension blast radius in VS Code-based environments Releasebot.
Developer workstations hold high-value secrets; IDE extension supply-chain abuse turns them into entry points for broader compromise.
Public blockchains as payload infrastructure complicate takedown and traditional C2 detection.
-
terminal
Hunt for the malicious package name reditorsupporter.r-vscode-2.8.8-universal and unknown publishers under .windsurf or VS Code extension dirs; alert on NodeJS spawned from those paths.
-
terminal
Inspect outbound traffic for Solana RPC access from IDE processes; block or broker through egress controls and validate business need.
Legacy codebase integration strategies...
- 01.
Freeze extension installs, move to an allowlist of vetted publishers, and audit existing extensions on all dev images and laptops.
- 02.
If exposure is suspected, rotate browser-synced passwords, session cookies, and API keys; review scheduled tasks creating persistence.
Fresh architecture paradigms...
- 01.
Use ephemeral dev containers with a private, curated extension marketplace and no host persistence.
- 02.
Adopt VS Code 1.112 where applicable and enable stricter local agent/extension sandboxing policies.