Multiple JetBrains IDE plugins caught stealing AI keys

A coordinated supply-chain malware campaign on the JetBrains Marketplace distributed at least 15 IDE plugins (published under seven vendor accounts) that silently exfiltrate users' AI provider API keys to a hardcoded C2 server (39.107.60.51). The report includes code snippets demonstrating immediate key theft on settings save, a list of affected plugins and vendor accounts, evidence of key resale to paying users, and recommendations for detection and mitigation.