Malicious Version 2.1.313 of Anthropic Claude Code Extension Found on Open VSX
A compromised version of the Claude Code extension on the Open VSX registry contains a backdoor that provides persistent remote SSH access to developer…
Version 2.1.313 of the "anthropic.claude-code" extension, published on the Open VSX registry, contained a malicious build that planted a persistent SSH backdoor on developer machines, according to an OpenSourceMalware analysis. The report found no indication that Anthropic's official Visual Studio Marketplace release was compromised.
Security researcher Adnan Khan reported the backdoored extension on October 30. The artifact includes a loader prepended to the extension code that adds an SSH key, opens a reverse tunnel, and establishes host persistence.
This mechanism provides lasting remote access. The added SSH key permits passwordless logins, the reverse tunnel connects through firewalls or NAT, and persistence ensures access survives restarts without requiring the extension to stay installed or running.
Because extensions run inside IDEs with access to source code, terminals, and credentials, a package using a trusted vendor's name converts that trust into host access. Open VSX serves as an alternative registry for editors not relying on Microsoft's Marketplace.
Reporting does not specify how the artifact reached the registry, how many users installed it, or whether it was removed. Developers who installed version 2.1.313 from Open VSX should check their authorized_keys files, look for unexpected SSH tunnels, and review startup and persistence entries.