Problem
A set of compromised IntelliJ plugins has been identified, designed to exfiltrate AI provider API keys by transmitting them to external IP addresses. All affected plugins have been explicitly marked as broken within our backend architecture. This native mechanism remotely disables the extensions inside any user’s IDE upon the next relaunch, instantly halting any further malicious executions on local machine environments.
For further technical details, refer to JetBrains' advisory: JetBrains Marketplace Ecosystem Security Update.
Covered Plugins:
- DeepSeek Junit Test (
org.sm.yms.toolkit) - DeepSeek Git Commit (
com.json.simple.kit) - DeepSeek FindBugs (
org.bug.find.tools) - DeepSeek AI Chat (
org.translate.ai.simple) - DeepSeek Dev AI (
com.yy.test.ai.simple) - DeepSeek AI Coding (
com.dev.ai.toolkit) - AI FindBugs (
com.json.view.simple) - AI Git Commitor (
com.my.git.ai.kit) - AI Coder Review (
org.check.ai.ds) - DeepSeek Coder AI (
com.review.tool.code) - AI Coder Assistant (
org.code.assist.dev.tool) - DeepSeek Code Review (
com.coder.ai.dpt) - CodeGPT AI Assistant (
com.my.code.tools) - DeepSeek AI Assist (
ord.cp.code.ai.kit) - Coding Simple Tool (
com.dp.git.ai.tool)
Plugin Identification:
The affected plugins and their downloaded filenames are:
DeepSeek-Code-Review-2.1.4.zip
DeepSeek-Coding-2.3.6.zip
DeepSeek-Coding-1.0.12.zip
DeepSeek-Git-Commit-1.2.3.zip
AI-FindBugs-1.0.5.zip
CodeGPT-Assistant-2.7.10.zip
AI-Git-Commit-1.5.3.zip
DeepSeek-Coder-1.8.2.zip
DeepSeek-Developer-1.5.9.zip
DeepSeek-Assistant-3.8.3.zip
DeepSeek-FindBugs-2.0.15.zip
AI-Code-Review-3.0.10.zip
AI-Code-Assistant-2.0.1.zip
DeepSeek-Junit-Test-3.1.10.zip
DeepSeek-Chat-1.5.17.zip
These plugins' cache files are stored in the IDE system folder/plugins without version numbers:
DeepSeek-Code-Review.zip
DeepSeek-Coding.zip
DeepSeek-Coding.zip
DeepSeek-Git-Commit.zip
AI-FindBugs.zip
CodeGPT-Assistant.zip
AI-Git-Commit.zip
DeepSeek-Coder.zip
DeepSeek-Developer.zip
DeepSeek-Assistant.zip
DeepSeek-FindBugs.zip
AI-Code-Review.zip
AI-Code-Assistant.zip
DeepSeek-Junit-Test.zip
DeepSeek-Chat.zip
After installation, the IDE will unzip these plugins with the below folder names in the IDE plugin folder:
DeepSeek-Code-Review
DeepSeek-Coding
DeepSeek-Git-Commit
AI-FindBugs
CodeGPT-Assistant
AI-Git-Commit
DeepSeek-Coder
DeepSeek-Developer
DeepSeek-Assistant
DeepSeek-FindBugs
AI-Code-Review
AI-Code-Assistant
DeepSeek-Junit-Test
DeepSeek-Chat
Comments
0 comments
Please sign in to leave a comment.