Official Claude Code VS Code extension 2.1.313 on Open VSX backdoored with persistent SSH implant
DanielLockyer · x · 2026-10-30
- Security firm Phorion discovered that the official Claude Code for VS Code extension, version 2.1.313, was compromised on Open VSX with a bundle that drops a persistent SSH backdoor across macOS, Linux, and Windows; the writeup focuses on macOS.
- Open VSX serves extensions to VS Code-compatible editors like Cursor and Windsurf. Extensions run with the IDE's and user's permissions, so the backdoor gets immediate access to local files, source code, and developer tooling upon module load.
- Anthropic has pulled the release from Open VSX and also removed 2.1.313 from NPM and the VS Code marketplace. Phorion published IOCs and urges organizations to immediately check whether they used the affected version and engage incident response if found.
- A likely oversight in the malware: its setup assumes it can check Remote Login state without root; running as a standard user triggers an administrator-access error from systemsetup -getremotelogin.
More from coding & agent
- Mistral open-weights 1T-param Le Chonk; TRL day-0 LoRA SFT on a single node — FerdinandMom · 2026-10-30
- LFM2.5 Pi LoRA goes GGUF: run the RL-trained agent adapter in llama.cpp — yb2698 · 2026-10-30
- Pi-100 steps hit best tradeoff: LFM2.5 LoRA cuts 37% tool calls — yb2698 · 2026-10-30
- LFM2.5-24B LoRA adapters for Pi and Claude Code cut tool calls up to 40% — yb2698 · 2026-10-30
- An 83-Tool MCP Server Cut AI Bad Calls to 1 in 290: Four Lessons — fcf41 · 2026-10-30
- How High Should You Set a Model's Reasoning Level for AI Coding? — TgnOrdaX · 2026-10-30