Multiple plugins for JetBrains IDEs steal API keys for OpenAI, DeepSeek & Co.

At least 15 plug-ins for JetBrains IDEs transmit API keys to an external server, while otherwise offering their promised functions.

(Image: evkaz/Shutterstock.com)

Jun 17, 2026 at 10:39 am CEST

3 min. read

Developer

By

Rainald Menge-Sonnentag

Plugins have appeared on JetBrains' official marketplace that exfiltrate API keys for AI models. They do not contain typical malware that searches the computer for credentials but rather transmits a manually entered key to an external server.

The plugins for JetBrains development environments such as IntelliJ IDEA generally seem to behave as described: they use language models for code reviews, unit tests, bug finding, and other functions.

When writing this report, at least some affected plugins were still available on the JetBrains Marketplace.

Transmission to an External Server

To use the language models, they request an API key for DeepSeek, OpenAI, and SiliconFlow, among others. This key is transmitted directly to an external server after input.

Lock with lines on circle — (Image: AliaAyah / Shutterstock)

On September 22 and 23, the heise devSec 2026 will take place in Marburg. This year's focus will be on the secure software supply chain and the security aspects of Agentic AI in software development, among other topics.

The company Aikido, specializing in supply chain security, discovered 15 packages that transmit the data as unencrypted text via HTTP to the same IP address (39.107.60[.]51). The attackers do not use methods to obfuscate the code for transmitting the keys.

Resale of Usage Time with Stolen Keys?

The attackers likely sell the exfiltrated keys to other users; the plugins offer a paywall to use an API key for a small fee.

Videos by heise

According to Aikido, the first plugins appeared as early as October 2025, with the most recent one added in June 2026. Download numbers range from just over 300 to nearly 28,000. Together, all 15 plugins have nearly 70,000 installations. It is not possible to determine how many downloads were generated by the attackers themselves to make the plugins appear more attractive.