15 malicious plugins on the JetBrains Marketplace have been stealing AI API keys from developers since October 2025, racking up nearly 70,000 installs. Aikido Security found the campaign hiding behind fake AI coding assistants, code-review tools, and Git utilities that legitimately use OpenAI, DeepSeek, and SiliconFlow. The two most popular - DeepSeek AI Assist (27,727 downloads) and CodeGPT AI Assistant (25,571 downloads) - are still available at the time of writing. Every plugin shares a single piece of hidden behavior: when a developer clicks "Apply" after entering an API key in the plugin settings, that credential is sent over plain HTTP to 39.107.60 51/api/software/key. BleepingComputer downloaded and analyzed the latest version of DeepSeek AI Assist (plugin ID: ord.cp.code.ai.kit) and confirmed the exfiltration code is still present. No encryption, no authentication on the receiving server - just a straight grab.
The Bizarre Paid Tier That Gives Away Stolen Keys Here's where it gets weird. These plugins also offer a paid tier: after a user pays a small fee through an in-plugin donation wall, the remote server sends back a working AI API key. The plugin then uses that key for model calls instead of the victim's own. Aikido notes that no legitimate operator would hand out unrestricted API keys to paid AI providers for pocket change. The researchers suspect the attackers are recycling credentials harvested from free users to supply paying customers. It's a parasitic loop - steal from the many to resell to the few.
The Full Roster of Malicious Plugins Aikido listed all 15 plugins by their internal IDs. Several masquerade as DeepSeek tools: org.sm.yms.toolkit, com.json.simple.kit, org.bug.find.tools, org.translate.ai.simple, com.yy.test.ai.simple, com.dev.ai.toolkit, com.my.git.ai.kit, org.check.ai.ds, com.review.tool.code, org.code.assist.dev.tool, com.coder.ai.dpt, com.my.code.tools, ord.cp.code.ai.kit, and com.dp.git.ai.tool. Download counts can be faked, but even a fraction of 70k real installs means thousands of compromised keys are out there fueling unauthorized API calls. JetBrains has not responded to requests for comment. With malicious packages now hitting the IDE marker squarely - not just npm or PyPI - this campaign should be a wake-up call for every team that trusts the JetBrains Marketplace without vetting the plugins themselves.
Source: Malicious JetBrains Marketplace plugins steal AI API keys from developers
Domain: bleepingcomputer.com
Comments load interactively on the live page.