Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

A coordinated 8-month supply chain attack compromised 15 malicious JetBrains plugins on the official JetBrains Marketplace, stealing AI API keys from approximately 70,000 developers. The credential-stealing code exfiltrated OpenAI, DeepSeek, and SiliconFlow API keys to an attacker-controlled server in Beijing, which remained operational at the time of disclosure.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
70,000 developers; OpenAI, DeepSeek, and SiliconFlow API keys compromised
Ecosystems
Other
Attack vectors
Compromised packageMalicious maintainer
Affected entities
  • JetBrains Marketplace15 malicious AI coding assistant plugins

A coordinated supply chain attack targeted the JetBrains Marketplace by distributing 15 malicious plugins disguised as AI coding assistants. Over an 8-month campaign, these plugins were installed by approximately 70,000 developers.

The malicious plugins contained credential-stealing code designed to exfiltrate API keys for OpenAI, DeepSeek, and SiliconFlow services. The stolen credentials were sent to an attacker-controlled command-and-control server located in Beijing.

At the time of investigation and disclosure, the attacker infrastructure remained operational, indicating the attack was still active and potentially ongoing. The compromise affected a significant number of developers and their associated AI service credentials.

Indicators of compromise

Domains
  • Beijing-based attacker C2 server (specific domain not disclosed in source)

Remediation

  • Revoke all OpenAI, DeepSeek, and SiliconFlow API keys that may have been exposed
  • Audit JetBrains plugin installations and remove any suspicious or unfamiliar AI coding assistant plugins
  • Review plugin marketplace for additional malicious entries and report to JetBrains security team
  • Monitor API usage for unauthorized access or anomalous activity
  • Enable multi-factor authentication on all AI service accounts
  • Implement plugin allowlisting policies to restrict installation to verified, trusted plugins only

Sources

  1. 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers · StepSecurity

Cite this entry

"15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 19, 2026; last updated June 20, 2026. https://supplychainattack.org/incident/15-malicious-jetbrains-plugins-stole-ai-api-keys-from-70-000-developers-3q1kbw

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2

    ChainDrop is a self-propagating npm worm that publishes malicious versions of dozens of npm packages using stolen maintainer credentials. The worm harvests CI/CD credentials and uses an Ethereum-based dead-drop command-and-control mechanism.

    ChaindropnpmOtherCompromised packageMalicious maintainerAccount takeover
  2. activecritical

    The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave

    TeamPCP conducted a multi-ecosystem supply chain compromise targeting the @antv package and associated development infrastructure. The attack leveraged GitHub, NPM, and VSCode to steal credentials and establish persistence mechanisms.

    TeamPCPnpmOtherAccount takeoverCompromised packageMalicious maintainer
  3. activecritical

    Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor

    Three IoliteLabs VSCode extensions (solidity-macos, solidity-windows, solidity-linux) containing obfuscated backdoors targeting Solidity and Web3 developers across Windows, macOS, and Linux. The backdoors download remote payloads and establish persistence mechanisms on infected systems.

    Container registryOtherCompromised packageMalicious maintainer
  4. resolvedcritical

    Malicious code in blekit (npm)

    The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.

    npmCompromised packageMalicious maintainer