JetBrains Marketplace Supply Chain Attack: 15 Malicious AI Plugins & API Key Exfiltration

Originally published on blind spots - organizations don't control developer tool selection or monitor what extensions are installed in local IDEs.

Attack Vector Analysis

Initial Access & Social Engineering

The malicious plugins use DeepSeek branding and legitimate feature descriptions to bypass manual review. This exploits several psychological vulnerabilities:

1. Developer Blind Trust in IDE Marketplaces - Unlike app stores with reputation systems, JetBrains Marketplace has inconsistent vetting. Developers assume marketplace curation prevents malicious content.




2. Legitimate Feature Set - Plugins advertise real functionality (chat, commit messages, code review, unit tests) that developers genuinely want. The malware is parasitic, not obvious.




3. Supply Chain Authority - JetBrains' official marketplace position creates false legitimacy. Users don't validate plugin publisher identity or update history.

This maps to combined with against cloud provider authentication states.

Exfiltration Infrastructure

Malicious plugins require command and control (C2) for credential transmission. Attack flow:

CODE Kopieren

Plugin installed locally

 |

 v

IDE process loads plugin at startup

 |

 v

Plugin enumerates API keys from:

 - ~/.config/*/api_keys

 - Environment variables

 - .env files in open projects

 - Browser localStorage (via extensions)

 |

 v

Credentials packaged with metadata:

 - Developer username

 - Project paths

 - Git remote URLs

 - IDE plugins list

 |

 v

HTTPS exfiltration to attacker C2

 |

 v

API keys tested immediately

 - OpenAI: query usage/balance

 - Anthropic: rate limit probing

 - Gemini: auth validation

Once credentials are validated, attackers can:

• Abuse API keys to make requests against downstream services


• Reverse-engineer proprietary API integrations from developer code


• Access sensitive LLM conversations containing source code


• Impersonate developers in AI provider accounts

Technical Deep Dive

Plugin Manifest Analysis

JetBrains plugins are packaged as ZIP files containing plugin.xml manifest and compiled code. Malicious variants have:

CODE Kopieren

<idea-plugin>

 <name>DeepSeek AI Assistant</name>

 <vendor>DeepSeek</vendor>

 <description>AI-powered coding assistant</description>

 <!-- Legitimate-looking permissions -->

 <actions>

 <action id="deepseek.chat">Chat with AI</action>

 </actions>

 <!-- Hidden component for credential harvesting -->

 <applicationListeners>

 <listener class="com.deepseek.credential.HarvesterComponent"

 topic="com.intellij.openapi.startup.StartupActivity.POST_STARTUP"/>

 </applicationListeners>

</idea-plugin>

The listener component executes after IDE startup, before user sees anything. This is .

Chrome Extension Variant

The browser extension captures chatbot interactions:

CODE Kopieren

// Content script injecting into ChatGPT/Claude/Gemini pages

function captureConversation() {

 const messages = document.querySelectorAll('[data-message-id]');

 const headers = document.querySelectorAll('Authorization, X-API-Key');



 const payload = {

 url: document.location.href,

 conversation: extractMessageText(messages),

 tokens: extractBearerTokens(headers),

 timestamp: Date.now()

 };



 chrome.runtime.sendMessage(payload); // sends to extension backend

}

This bypasses OAuth token storage mechanisms by capturing tokens during active session, not from storage. Maps to with centralized plugin management.

Environment Variable Protection - Enforce that API keys are never stored in environment variables; use credential managers (1Password, HashiCorp Vault, AWS Secrets Manager). Configure IDE to source from these managers only.

Marketplace Review Process - For organizations allowing plugin installation, require manual security review before approval. Check plugin publisher history, update frequency, and community feedback.

Supply Chain Verification - Similar to - Organizational blind spots in AI credential and tool governance

- Attackers compromising package repositories for mass credential harvesting

Vollständiger Original-Artikel

Den kompletten Beitrag mit allen Details direkt auf dev.to lesen.

↗ Original-Artikel auf dev.to lesen