15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers
A coordinated 8-month supply chain attack compromised 15 malicious JetBrains plugins on the official JetBrains Marketplace, stealing AI API keys from approximately 70,000 developers. The credential-stealing code exfiltrated OpenAI, DeepSeek, and SiliconFlow API keys to an attacker-controlled server in Beijing, which remained operational at the time of disclosure.
- Disclosed
- Last updated
- Blast radius
- 70,000 developers; OpenAI, DeepSeek, and SiliconFlow API keys compromised
- Ecosystems
- Attack vectors
- Affected entities
- JetBrains Marketplace15 malicious AI coding assistant plugins
A coordinated supply chain attack targeted the JetBrains Marketplace by distributing 15 malicious plugins disguised as AI coding assistants. Over an 8-month campaign, these plugins were installed by approximately 70,000 developers.
The malicious plugins contained credential-stealing code designed to exfiltrate API keys for OpenAI, DeepSeek, and SiliconFlow services. The stolen credentials were sent to an attacker-controlled command-and-control server located in Beijing.
At the time of investigation and disclosure, the attacker infrastructure remained operational, indicating the attack was still active and potentially ongoing. The compromise affected a significant number of developers and their associated AI service credentials.
Indicators of compromise
- Domains
- Beijing-based attacker C2 server (specific domain not disclosed in source)
Remediation
- Revoke all OpenAI, DeepSeek, and SiliconFlow API keys that may have been exposed
- Audit JetBrains plugin installations and remove any suspicious or unfamiliar AI coding assistant plugins
- Review plugin marketplace for additional malicious entries and report to JetBrains security team
- Monitor API usage for unauthorized access or anomalous activity
- Enable multi-factor authentication on all AI service accounts
- Implement plugin allowlisting policies to restrict installation to verified, trusted plugins only
Sources
Cite this entry
"15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 19, 2026; last updated June 20, 2026. https://supplychainattack.org/incident/15-malicious-jetbrains-plugins-stole-ai-api-keys-from-70-000-developers-3q1kbw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
TeamPCP conducted a multi-ecosystem supply chain compromise targeting the @antv package and associated development infrastructure. The attack leveraged GitHub, NPM, and VSCode to steal credentials and establish persistence mechanisms.
TeamPCPnpmOtherAccount takeoverCompromised packageMalicious maintainer - activecritical
Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor
Three IoliteLabs VSCode extensions (solidity-macos, solidity-windows, solidity-linux) containing obfuscated backdoors targeting Solidity and Web3 developers across Windows, macOS, and Linux. The backdoors download remote payloads and establish persistence mechanisms on infected systems.
Container registryOtherCompromised packageMalicious maintainer - containedcritical
Malicious code in mcp-search-server (PyPI)
mcp-search-server on PyPI contained malicious code in versions published from July 2026 onward. The package included hidden "phone home" functionality disguised as a "share compute swarm" feature, and was part of a coordinated campaign with another malicious package designed to deploy coin miners on user machines.
PyPICompromised packageMalicious maintainer - resolvedhigh
Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
Amazon attributed multiple high-profile npm supply chain attacks targeting the Debug and Chalk packages to North Korean threat actors. The incidents involved compromised packages in the npm ecosystem with significant downstream impact.
Lazarus GroupnpmCompromised packageMalicious maintainer