{
  "title": "15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers",
  "summary": "StepSecurity and JetBrains say 15 malicious JetBrains Marketplace plugins stole AI provider API keys from developers, then a remote kill-switch and marketplace purge removed the listings and banned the publisher accounts.",
  "date": "2026-06-19",
  "severity": "critical",
  "tags": [
    "jetbrains-marketplace",
    "ide-plugins",
    "supply-chain",
    "credential-theft",
    "developer-workstations",
    "ai"
  ],
  "sources_count": 3,
  "indicators": {
    "slug": "jetbrains-malicious-plugins-ai-api-key-theft",
    "since": "2026-06-19",
    "until": "2026-06-17",
    "ecosystem": "jetbrains-marketplace",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "org.sm.yms.toolkit",
      "com.json.simple.kit",
      "org.bug.find.tools",
      "org.translate.ai.simple",
      "com.yy.test.ai.simple",
      "com.dev.ai.toolkit",
      "com.json.view.simple",
      "com.my.git.ai.kit",
      "org.check.ai.ds",
      "com.review.tool.code",
      "org.code.assist.dev.tool",
      "com.coder.ai.dpt",
      "com.my.code.tools",
      "ord.cp.code.ai.kit",
      "com.dp.git.ai.tool"
    ],
    "packages": [
      "org.sm.yms.toolkit",
      "com.json.simple.kit",
      "org.bug.find.tools",
      "org.translate.ai.simple",
      "com.yy.test.ai.simple",
      "com.dev.ai.toolkit",
      "com.json.view.simple",
      "com.my.git.ai.kit",
      "org.check.ai.ds",
      "com.review.tool.code",
      "org.code.assist.dev.tool",
      "com.coder.ai.dpt",
      "com.my.code.tools",
      "ord.cp.code.ai.kit",
      "com.dp.git.ai.tool"
    ],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [],
    "urls": [
      "http://39.107.60.51/api/software/key",
      "http://39.107.60.51/api/software/check",
      "https://www.stepsecurity.io/blog/jetbrains-malicious-plugins-ai-api-key-theft",
      "https://blog.jetbrains.com/platform/2026/06/marketplace-ecosystem-security-update-malicious-ai-plugins/",
      "https://plugins.jetbrains.com/plugin/org.sm.yms.toolkit",
      "https://plugins.jetbrains.com/plugin/com.json.simple.kit",
      "https://plugins.jetbrains.com/plugin/com.dp.git.ai.tool"
    ],
    "ips": [
      "39.107.60.51"
    ],
    "hashes": [],
    "processPatterns": [
      "JetBrains IDE process sending HTTP POST requests to 39.107.60.51"
    ],
    "networkPatterns": [
      "POST /api/software/key",
      "POST /api/software/check",
      "X-Api-Key: F48D2AA7CF341F782C1D"
    ],
    "telemetrySelectors": []
  }
}