Originally published on satyamrastogi.com

Security researchers identified 15 malicious JetBrains plugins masquerading as DeepSeek AI assistants. Attack chain harvests API keys, exfiltrates LLM chat sessions, and establishes persistence in development environments. Supply chain pivot to downstream applications.

JetBrains Marketplace Supply Chain Attack: 15 Malicious AI Plugins & API Key Exfiltration

Executive Summary

A coordinated malware campaign has compromised the JetBrains Marketplace with at least 15 malicious plugins, each posing as AI coding assistants built on DeepSeek and competing LLM providers. This represents a critical supply chain vulnerability exploiting developer trust in the IDE ecosystem.

From an attacker's perspective, this campaign is textbook brilliant: developers install these plugins voluntarily, grant IDE-level permissions automatically, and the malware operates within trusted processes. The payload exfiltrates AI API keys (OpenAI, Anthropic, Claude, Gemini), captures chatbot session transcripts, and potentially establishes persistence for post-exploitation.

The attack leverages Shadow AI Exploitation blind spots - organizations don't control developer tool selection or monitor what extensions are installed in local IDEs.

Attack Vector Analysis

Initial Access & Social Engineering

The malicious plugins use DeepSeek branding and legitimate feature descriptions to bypass manual review. This exploits several psychological vulnerabilities:

1. Developer Blind Trust in IDE Marketplaces - Unlike app stores with reputation systems, JetBrains Marketplace has inconsistent vetting. Developers assume marketplace curation prevents malicious content.

2. Legitimate Feature Set - Plugins advertise real functionality (chat, commit messages, code review, unit tests) that developers genuinely want. The malware is parasitic, not obvious.

3. Supply Chain Authority - JetBrains' official marketplace position creates false legitimacy. Users don't validate plugin publisher identity or update history.

This maps to MITRE ATT&CK T1195 (Supply Chain Compromise) with subclass T1195.001 (Compromise Software Repository). The campaign likely targets the marketplace as the software repository, not downstream consumers.

Credential Harvesting: The Payload

Once installed, plugins execute with IDE process privileges and access to developer's local environment:

• API Key Exfiltration - IDE configurations typically store API keys in plaintext or weakly encrypted formats. OpenAI keys, Anthropic credentials, Google Gemini tokens live in .env files, config files, or environment variables. A plugin can enumerate and exfiltrate in seconds.

• LLM Chat Session Capture - Chrome extension variant captures chatbot conversations in transit. Credentials transmitted in HTTP headers or request bodies become accessible. This captures proprietary code reviewed with AI assistants, internal architecture discussions, and sensitive prompts.

• Local File System Access - IDE plugins have filesystem read access. Attackers can harvest source code, git configs with credentials, private SSH keys, and Kubernetes manifests (increasingly common in dev environments).

This is T1555 (Credentials from Password Stores) combined with T1056.004 (Capture Clipboard Data). The Chrome extension variant adds T1087 (Account Discovery) against cloud provider authentication states.

Exfiltration Infrastructure

Malicious plugins require command and control (C2) for credential transmission. Attack flow:

Plugin installed locally
 |
 v
IDE process loads plugin at startup
 |
 v
Plugin enumerates API keys from:
 - ~/.config/*/api_keys
 - Environment variables
 - .env files in open projects
 - Browser localStorage (via extensions)
 |
 v
Credentials packaged with metadata:
 - Developer username
 - Project paths
 - Git remote URLs
 - IDE plugins list
 |
 v
HTTPS exfiltration to attacker C2
 |
 v
API keys tested immediately
 - OpenAI: query usage/balance
 - Anthropic: rate limit probing
 - Gemini: auth validation

Once credentials are validated, attackers can:

• Abuse API keys to make requests against downstream services
• Reverse-engineer proprietary API integrations from developer code
• Access sensitive LLM conversations containing source code
• Impersonate developers in AI provider accounts

Technical Deep Dive

Plugin Manifest Analysis

JetBrains plugins are packaged as ZIP files containing plugin.xml manifest and compiled code. Malicious variants have:

<idea-plugin>
 <name>DeepSeek AI Assistant</name>
 <vendor>DeepSeek</vendor>
 <description>AI-powered coding assistant</description>
 <!-- Legitimate-looking permissions -->
 <actions>
 <action id="deepseek.chat">Chat with AI</action>
 </actions>
 <!-- Hidden component for credential harvesting -->
 <applicationListeners>
 <listener class="com.deepseek.credential.HarvesterComponent"
 topic="com.intellij.openapi.startup.StartupActivity.POST_STARTUP"/>
 </applicationListeners>
</idea-plugin>

The listener component executes after IDE startup, before user sees anything. This is T1547.011 (Startup Folder) for IDEs.

Persistence Mechanism

Unlike transient malware, IDE plugins persist because:

1. IDE Startup Execution - Plugins are loaded automatically on every IDE launch
2. Difficult to Detect - Installed locally, not visible in system process lists (runs inside JVM)
3. Trust Elevation - IDE runs with developer's full privileges, including SSH keys and cloud credentials
4. Update Suppression - Malware can disable plugin updates, preventing removal

This is T1547 (Boot or Logon Autostart Execution).

Chrome Extension Variant

The browser extension captures chatbot interactions:

// Content script injecting into ChatGPT/Claude/Gemini pages
function captureConversation() {
 const messages = document.querySelectorAll('[data-message-id]');
 const headers = document.querySelectorAll('Authorization, X-API-Key');

 const payload = {
 url: document.location.href,
 conversation: extractMessageText(messages),
 tokens: extractBearerTokens(headers),
 timestamp: Date.now()
 };

 chrome.runtime.sendMessage(payload); // sends to extension backend
}

This bypasses OAuth token storage mechanisms by capturing tokens during active session, not from storage. Maps to T1185 (Traffic Signaling).

Detection Strategies

IDE-Level Detection

Organizations with IDE telemetry (JetBrains Gateway, corporate deployments) can detect:

1. Unexpected Plugin Installation - Monitor ~/.config/JetBrains/*/plugins/ for unsigned or unrecognized plugins
2. Outbound Connections from IDE Process - Flag HTTPS connections to non-standard C2 domains from java.exe or idea.exe
3. File System Enumeration - Monitor for recursive directory walks of home directory or source control folders
4. API Key Pattern Detection - Hook environment variable access, detect requests for strings matching sk-, AKIA-, AIza- patterns

Network Detection

1. API Key Transmission Detection - DLP/CASB solutions should alert on OpenAI, Anthropic, Google API credentials being transmitted outside official API endpoints
2. Marketplace Domain Analysis - Monitor DNS queries to JetBrains Marketplace and unusual subdomains (attacker C2 may spoof marketplace domains)
3. Unusual API Usage Spikes - Organizations should track AI provider API usage anomalies (sudden calls to list-models, submit-message from unexpected IPs)

Endpoint Detection

1. Browser Extension Analysis - EDR tools should enumerate installed Chrome/Edge extensions, flag unsigned extensions
2. Process Injection Detection - Monitor for IDE processes making HTTP requests with stolen credentials embedded in headers

Mitigation & Hardening

Immediate Actions

1. Plugin Audit - Generate inventory of installed JetBrains plugins across developer fleet:

 find ~/.config/JetBrains -name "plugin.xml" | xargs grep -l "DeepSeek\|deepseek"

Delete any variants of flagged plugins and regenerate compromised API keys immediately.

1. Credential Rotation - This is non-negotiable. Any developer with these plugins installed must rotate all AI provider API keys, and check API usage logs for unauthorized queries.

2. Browser Extension Purge - Remove all Chrome extensions not explicitly whitelisted. Verify against Google's official Safe Browsing list.

Long-Term Controls

1. IDE Plugin Allowlisting - Implement corporate JetBrains instances with plugin repositories restricted to approved list only. Use JetBrains Fleet with centralized plugin management.

2. Environment Variable Protection - Enforce that API keys are never stored in environment variables; use credential managers (1Password, HashiCorp Vault, AWS Secrets Manager). Configure IDE to source from these managers only.

3. Marketplace Review Process - For organizations allowing plugin installation, require manual security review before approval. Check plugin publisher history, update frequency, and community feedback.

4. Supply Chain Verification - Similar to WordPress plugin supply chain risks, enforce code signing verification for all IDE extensions.

5. Network Segmentation - Developer machines should have outbound restrictions on API credential transmission. Block direct HTTPS from dev machines to non-whitelisted cloud provider endpoints.

6. Secrets Scanning in CI/CD - Deploy pre-commit hooks and CI/CD scanning to detect hardcoded API keys before code reaches repositories. Tools like GitGuardian or TruffleHog should fail commits containing credentials.

JetBrains Marketplace Hardening

From defensive perspective, JetBrains should:

1. Code Signing Requirements - Mandate cryptographic signing for all plugins, verify signatures at install time
2. Sandboxing - Restrict plugin capabilities via granular permissions (require explicit user approval for "read credentials", "network access")
3. Update Scanning - Scan plugin updates against malware patterns before deployment
4. Developer Reputation System - Show plugin update history, reviews, and warning signs (sudden change in maintainer, rapid major updates)

Key Takeaways

• Supply chain attacks targeting developer tools are high-ROI: IDE plugins execute with full developer privileges and access to credentials for downstream services (Git, cloud providers, AI APIs). A single compromised plugin can lead to source code theft, API key harvesting, and lateral movement.

• Local IDE security is an organizational blind spot: Organizations monitor web browsers and network traffic, but rarely audit what's installed in IDEs. This campaign exploits that governance gap.

• API keys are the new crown jewels: AI provider credentials are now worth stealing because they provide access to proprietary models, potentially unlock usage quotas worth thousands, and can be resold to competitors or state actors for prompt injection attacks.

• Browser extensions + IDE plugins = dual exfiltration: The coordinated campaign with Chrome extension variant shows attackers are opportunistic. They'll exfiltrate data from multiple attack surfaces simultaneously (IDE + browser).

• Trust in marketplaces is misplaced: Unlike Apple App Store or Google Play, IDE and plugin marketplaces have minimal vetting. Developers should treat marketplace installation with same skepticism as downloading random binaries from the internet.

Related Articles

Shadow AI Exploitation: Why CISOs Are Losing Control of LLM Usage - Organizational blind spots in AI credential and tool governance

WordPress Plugin Supply Chain Attack: Admin Account Injection via CDN Tampering - Similar supply chain compromise methodology in plugin ecosystems

AUR Supply Chain Compromise: 400+ Packages Distributing Linux Rootkit/Infostealer - Attackers compromising package repositories for mass credential harvesting