Claude Code VS Code extension reportedly compromised on Open VSX
The oss-security note says the Microsoft Visual Studio Marketplace copy was allegedly not affected, but the post is incomplete.
Stories per day · 30 days
2 RSS
8 stories, newest first · one card per story
Stories tagged #open-vsx
Poisoned Claude Code extension on Open VSX planted an SSH backdoor
Version 2.1.313 was on Cursor’s marketplace for about 11 hours; Cursor says at most 5,000 users were affected.
1
Malicious Claude Code VS Code extension installed an SSH backdoor
Cursor says at most 5,000 users got version 2.1.313 on October 29; Anthropic replaced it with 2.1.314.
4
Trojanized Claude Code extension on Open VSX installs an SSH backdoor
Version 2.1.313 beacons to 134.209.82.225 and plants an Ed25519 key; Anthropic’s Microsoft Marketplace build is not implicated.
1
Malicious Claude Code extension on Open VSX plants an SSH backdoor
OpenSourceMalware says anthropic.claude-code 2.1.313 adds an SSH key, reverse tunnel, and startup scripts; Anthropic’s official release is not shown compromised.
1
GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware
GlassWorm-linked VS Code theme extensions hide downloaders that fetch Windows malware, including a blockchain-addressed in-memory loader.
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
GlassWorm-linked malicious VS Code color themes on Visual Studio Marketplace and Open VSX shipped staged JavaScript loaders that pulled C2 addresses from Solana memos.
8
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
3