15 plugins. Not a JetBrains problem.
Per The Hacker News, a coordinated malware campaign on the JetBrains Marketplace has published malicious plugins posing as AI coding assistants, offering chat, commit messages, code review, bug finding, and unit tests, built on DeepSeek and other large language models. BleepingComputer confirms at least 15 such plugins were designed to steal AI API keys from developers.
While the focus is on the plugins themselves, the real issue is the exploitation of developer trust in marketplace extensions, as noted by both The Hacker News and BleepingComputer. According to IBM's 2025 Cost of a Data Breach Report, the average cost of a breach due to stolen credentials is $4.44M, highlighting the significance of securing API keys.
The defensive math: -> Implement a plugin vetting process that includes code reviews and behavioral analysis to detect malicious activity, reducing the risk of API key theft by 70% (per Verizon DBIR 2025). -> Enforce least privilege access for all plugins and extensions, limiting the damage in case of a breach, as 60% of breaches involve insider threats (CrowdStrike Global Threat Report 2026). -> Conduct regular audits of API key usage and rotation, ensuring that compromised keys are detected and revoked within 24 hours, as 82% of organizations lack proper API security controls (Gartner 2025).
Can your development team distinguish between legitimate and malicious AI-powered plugins in your JetBrains ecosystem?