在JetBrains Marketplace上发现了恶意的AI编码助手插件，对开发者构成了重大的安全风险。这些插件约有15个，下载量接近7万次，旨在窃取DeepSeek和OpenAI等热门AI服务的API密钥。这些插件至少自2025年10月以来一直活跃，其中一些还包含一个记录聊天机器人对话的Chrome扩展程序，进一步危及用户数据。 AI
影响 受损的API密钥可能导致未经授权访问AI服务，可能扰乱开发工作流程并暴露敏感数据。
排序理由 该集群描述了通过开发者工具市场分发的恶意插件，这是一个与软件工具相关的安全问题。
在 Mastodon — fosstodon.org 阅读 →
AI 生成摘要 · Google Gemini · 来自 4 个来源。 我们如何撰写摘要 →
Hackers are using fake AI coding assistants on the # JetBrains Marketplace to steal DeepSeek, OpenAI, and other developer API keys - 15 malicious plugins, nearly 70K downloads, and fake reviews used to lure developers. Read: https:// hackread.com/malicious-jetbrai ns-plugins-stea…
🚨Cybersecurity Alert🚨 Beware of 15 malicious JetBrains plugins! They've been stealthily stealing AI API keys since October 2025! Even popular chatbot conversations aren't safe with a separate Chrome extension campaign recording them. Update your cybersecurity measures now! 🔒 # Cy…
Malicious # JetBrains Marketplace plugins steal # AI # API keys from developers https://www. bleepingcomputer.com/news/secu rity/malicious-jetbrains-marketplace-plugins-steal-ai-api-keys-from-developers/ # cybersecurity
JetBrains Marketplace Ecosystem Security Update: Addressing Malicious Third-Party AI Plugins # ai # ide # intellij # intellijidea # java # jetbrains # kotlin # marketplace # plugins https:// blog.jetbrains.com/platform/20 26/06/marketplace-ecosystem-security-update-malicious-ai-p…