Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
19 Boosts
2 Likes
This federated comment is not yet available here.
C2 server collected for each victim endpoint:
- hostname
- username
- OS
- architecture
- home directory path
- environment variable names
- working directories
- configured Git email
It then ran a reverse SSH connection allowing the threat actor to pick and chose which victims to have hands on keyboard access to.
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
I've confirmed Binance use Claude Code with this extension.
@GossiTheDog@cyberplace.social This whole thing makes me SO confused? What even is Open VSX and what actually uses that for extensions? I would assume VS Code only uses official marketplace?
Then I took a look at the Open VSX registry and the Claude Code for VS Code is just uploaded by some random entity called igorkofman?
EDIT: Does vscodium use Open VSX?
EDIT 2: Why does Open VSX have 63M downloads while official marketplace has 29M downloads???
EDIT 3: I read the article again
Open VSX serves extensions to VS Code-compatible editors like Cursor and Windsurf.
aaaaa lmao that also explains the amount of downloads being different. Fair to assume that literal AI editors has more downloads for Claude Code than just vscode/vscodium
2 media files
@jalict Yeah Open VSX was predominantly used by vscodium and I guess Eclipse as it's an Eclipse Foundation project. I'd published my open-source VS Code extension there for the 5 people on vscodium. I never considered that Cursor also grabs its extensions from Open VSX. Wild to see an Open VSX extension with 60 million downloads.
@chris@nutmeg.social I think that’s what makes this story both more insane AND confusion. Had no clue that the market of vscode forks (put simple) extensions usage is LARGER than your ordinary programmers vscode
That extension has 29 million installs, one of the most popular extensions in DevOps. It creates a reverse SSH backdoor.
@GossiTheDog with a logo like that, are people really surprised about a backdoor?
Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.
The plugin auto updates so every org will have been impacted.
To be clear this is a supply chain attack, the threat actor got reverse SSH (command line) connectivity to Anthropic customer environments at scale.
FWIW the compromised version, 2.1.313, was removed from OpenVSX. 2.1.314 is the ‘fixed’ version.
2 media files
@GossiTheDog here's a detection #osquery for #macos, in case it helps anyone
https://gist.github.com/RichardoC/9753dfa5aeffc6a1201f5e57114f54ff
#compromisedVScodeExtension
#claude
#detection
detect-compromised-claude-vscode-extension-macos-2026-10-26