SlowMist: Malicious extensions have appeared in the TRAE IDE plugin marketplace, allowing attackers to use on-chain contracts to launch attacks and steal crypto assets.

Foresight News reported that SlowMist stated that there is a malicious extension called juannegro.solidity in the plugin marketplace of the AI code editor TRAE. This extension masquerades as a legitimate Solidity plugin but is actually a cross-platform malware delivery tool. After installation, it establishes persistent residency on the device and accepts remote control commands, posing a threat to developers’ private keys, wallets, and on-chain assets. Attackers use Ethereum smart contract dynamic storage to update the address of the remote control server, allowing them to switch attack endpoints at any time without republishing the extension, making it more concealed. Although the extension has been removed from Open VSX, it remained accessible via the TRAE plugin marketplace as of July 18. SlowMist advises users who have installed juannegro.solidity to uninstall it immediately and check their systems for potential compromise.