Fake Solidity and Hardhat extensions on Open VSX install backdoor on Macs, Pluto says

What happened

According to Pluto Security, a new wave of a campaign it calls EtherDuck, part of SleepyDuck, put fake Solidity and Hardhat extensions on Open VSX, the extension store used by editors such as Cursor, Windsurf and VSCodium. Pluto ties it to the same actor behind earlier SleepyDuck and ScreenConnect campaigns. As far as the sources we have show, Pluto is the only researcher to have published on these waves.

Pluto says the listings imitated legitimate tooling and inflated their download counts to outrank genuine extensions in search. Displayed download numbers on these listings are not real install counts. The four extension IDs Pluto lists are alejandroaranda.solidity-languini, alejandroaranda.solidity-langsupport, juanfranblanco.solidity-vscode and Nomic-ETH.hardhat-solidity.

Pluto says that when the extension activates, it starts a hidden Node process that runs a bundled video file. A custom archive appended after the video data holds payloads for each platform. On macOS and Linux the payload is a Go backdoor that reads its server address from an Ethereum smart contract. On a Mac, Pluto says, it removes its own quarantine flag so Gatekeeper never warns, and adds a LaunchAgent so it starts at every login. It checks for virtual machines, debuggers and sandboxes and exits silently if it finds them. On Windows, Pluto says victims get a ScreenConnect remote access client.

Pluto says Open VSX removed each malicious wave after about 19 hours, but the operator came back within hours under a new publisher account with the same payloads and added anti-VM and anti-debugger checks. Pluto says uninstalling the extension does not remove the malware; the installed background process keeps running.

Timeline

1. 14 Mar 2026

   Pluto says the Ethereum contract the backdoor later reads its server address from was deployed.[1]

2. 24 Sep 2026
   23:42 UTC

   The first two fake listings appeared under the publisher janeykomit.[1]

3. 25 Sep 2026
   18:35 UTC

   Open VSX confirmed both listings removed, about 19 hours after they appeared.[1]

4. 25 Sep 2026, 22:40 UTC

   Re-uploaded fake listings reached their final versions under a new publisher, dbolovetoa.[1]

5. 26 Sep 2026
   17:35 UTC

   Open VSX confirmed the re-uploaded listings removed.[1]

6. 1 Oct 2026

   Pluto Security published its report on the campaign.[1]

Who is affected

• Solidity developers who installed any of the four listed extensions from Open VSX, in Cursor, Windsurf, VSCodium or other editors that use that store.
• Anyone who has or ever had these extensions installed should treat the machine as compromised, since Pluto says a compromised workstation can expose credentials and deployment authority.
• Developers who relied on displayed download counts to judge which Solidity extension was genuine.

How to check

1. Look in your editor's extensions list for the four IDs: alejandroaranda.solidity-languini, alejandroaranda.solidity-langsupport, juanfranblanco.solidity-vscode and Nomic-ETH.hardhat-solidity, including past installs.
2. On a Mac, look for a hidden .solidity folder in your home directory and for a related LaunchAgent in your user Library.
3. Check network logs for connections to the command-and-control addresses Pluto lists, and for repeated Ethereum calls to the config contract from a process that is not a wallet.

What to do

1. Disconnect the machine from the network first to cut the active command channel.
2. Do not rely on uninstalling the extension; it does not remove the backdoor.
3. Remove the payload folder and the LaunchAgent, or better, rebuild the Mac.
4. Rotate every credential the machine could reach: SSH keys, cloud sessions, publishing tokens and above all wallet keys and contract deployment keys.
5. Install Solidity tooling only from the real publishers and block by publisher account and payload hash, not extension name alone.