Critical JetBrains IDE Plugin Vulnerabilities Expose AI Keys

Key Takeaways

• A widespread malware campaign infiltrated the JetBrains Marketplace, distributing at least 15 malicious IDE plugins.
• These plugins, masquerading as AI coding assistants, stole sensitive API keys for services like OpenAI, DeepSeek, and SiliconFlow from developers.
• Over 70,000 downloads were recorded across seven distinct vendor accounts, with the campaign active since October 2025 and new plugins appearing as recently as June 2026.
• The stolen API keys were exfiltrated to a hardcoded command-and-control server, potentially enabling a resale scheme where compromised keys are redistributed to paying users of the malicious plugins.
• Developers are urged to remove affected plugins immediately, revoke and rotate compromised API keys, and adopt enhanced supply chain security practices.

Malicious JetBrains IDE Plugins Caught Stealing AI API Keys

A sophisticated malware operation has been uncovered within the JetBrains Marketplace, utilizing a network of at least 15 deceptive IDE plugins to illicitly harvest sensitive API keys from unsuspecting developers. These plugins, collectively downloaded more than 70,000 times, were distributed under seven different vendor accounts and cunningly disguised as legitimate AI-powered coding tools.

Research conducted by Aikido revealed that the malicious plugins presented themselves as offering valuable developer functionalities, including AI chat, code generation, bug detection, automated commit message creation, and unit test writing. While appearing fully functional and delivering their advertised features, they secretly operated to siphon off users’ API keys in the background.

Inside the API Key Theft Mechanism

Aikido researchers discovered that all identified malicious plugins shared a nearly identical codebase, with minor alterations and rebranding used for republication under various names. To leverage these tools, developers were prompted to input their API keys for popular services such as OpenAI, DeepSeek, or SiliconFlow.

The moment a user entered an API key and clicked “Apply,” the plugin instantly captured and exfiltrated the key without any explicit warning or consent. The malicious logic was cleverly embedded within the plugin’s settings handler, facilitating immediate and covert data theft. The stolen API keys were transmitted via an unencrypted HTTP POST request to a hardcoded command-and-control (C2) server located at 39.107.60[.]51. This use of plaintext HTTP further exposed sensitive credentials to potential interception and misuse.

Adding another layer of deception, some plugins even offered a paid tier. After a user made a payment, the plugin would receive a new API key from the attacker-controlled server and begin using it in place of the user’s originally entered key. Aikido speculates this could indicate a resale operation, where compromised API keys from victims are resold or redistributed to the attackers’ paying customers. This strategy would allow the threat actors to monetize both stolen credentials and paid subscriptions, effectively offloading operational costs onto their victims.

Campaign Scope and Supply Chain Implications

The campaign’s origins trace back to October 2025, with evidence of new malicious plugins continuing to emerge as recently as June 2026. Aikido’s analysis suggests the actual impact might be considerably higher than reported download counts indicate, as plugin download statistics can be manipulated, and fake positive reviews were observed across several listings.

Integrated Development Environments (IDEs) are increasingly becoming prime targets for supply chain attacks due to the highly sensitive information they manage, including source code, various credentials, signing keys, and now, AI service API keys. IDE plugins typically operate with elevated privileges and are inherently trusted by developers, making them an ideal vector for stealthy compromise. Even with JetBrains’ manual review processes, small, hidden malicious functions can sometimes evade detection.

Indicators of Compromise (IOCs)

C2 Server

• 39.107.60[.]51

Affected Plugins

• DeepSeek Junit Test (org.sm.yms.toolkit) – 1,121 downloads
• DeepSeek Git Commit (com.json.simple.kit) – 1,894 downloads
• DeepSeek FindBugs (org.bug.find.tools) – 1,485 downloads
• DeepSeek AI Chat (org.translate.ai.simple) – 1,317 downloads
• DeepSeek Dev AI (com.yy.test.ai.simple) – 740 downloads
• DeepSeek AI Coding (com.dev.ai.toolkit) – 450 downloads
• AI FindBugs (com.json.view.simple) – 623 downloads
• AI Git Commitor (com.my.git.ai.kit) – 301 downloads
• AI Coder Review (org.check.ai.ds) – 735 downloads
• DeepSeek Coder AI (com.review.tool.code) – 3,498 downloads
• AI Coder Assistant (org.code.assist.dev.tool) – 319 downloads
• DeepSeek Code Review (com.coder.ai.dpt) – 278 downloads
• CodeGPT AI Assistant (com.my.code.tools) – 25,571 downloads
• DeepSeek AI Assist (ord.cp.code.ai.kit) – 27,727 downloads
• Coding Simple Tool (com.dp.git.ai.tool) – 3,931 downloads

Vendor Accounts

• CodePilot (mycode)
• StackSmith (misshewei)
• CodeCrafter (keteme)
• CodeWeaver (simpledev)
• JetCode (skyblue)
• DailyCode (dialycode)
• ZenCoder (947cb4c8-5db1-4cf0-8182-0aae7c433bb3)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Remove Affected Plugins: Immediately identify and uninstall any of the listed malicious plugins from your JetBrains IDE.
• Revoke and Rotate API Keys: For any services (e.g., OpenAI, DeepSeek, SiliconFlow) whose API keys were entered into these plugins, revoke the compromised keys without delay and generate new ones.
• Monitor for Unusual Activity: Closely monitor API usage and billing statements for any unexpected spikes or unauthorized activity indicative of key misuse.
• Exercise Caution with Third-Party Plugins: Treat all IDE plugins as high-risk dependencies. Prioritize plugins from well-established, reputable publishers and avoid entering sensitive credentials into tools that lack proper verification.
• Implement Supply Chain Security: Organizations should deploy endpoint monitoring and software supply chain security solutions to proactively detect and prevent the inclusion of malicious packages in development environments.
• Educate Developers: Reinforce awareness among development teams regarding the risks associated with third-party tools and the importance of vigilance against developer-focused supply chain attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.