Trojanized Claude Code extension plants persistent SSH backdoor
elffjs · hn · 2026-10-30
A trojanized Claude Code extension has been found planting a persistent SSH backdoor, giving attackers lasting remote access to machines of developers who installed it. The incident underscores supply-chain risks in the ecosystem of third-party extensions around AI coding tools.
More from coding & agent
- Scratching His Own Itch: Dev Turns Unreliable Social APIs Into ReachSocial.dev — FewScarcity6957 · 2026-10-31
- Microsoft's ScholarEvolve evolves agent harnesses with frozen models, +14 points on AppWorld — jiqizhixin · 2026-10-31
- Team uses Gemini as a subagent for tricky architecture and system design problems — AccBalanced · 2026-10-31
- Toska: Open-Source Krita Fork With an Agentic AI Painter for Under $7/Month — yawk-ra · 2026-10-31
- 'Don't use tools you can't fully control': OpenClaw pitch sparks agent autonomy debate — heyneighbor · 2026-10-31
- Dev builds Waifu Weather iOS app entirely with Claude Code, from Blender 3D modeling to music — MurkyGiraffe5879 · 2026-10-31