📅 30 October 2026 • helpnetsecurity.com. A malicious build of Anthropic's Claude Code extension was published on the Open VSX registry on 29 October and stayed live for about 11 hours before it was removed. The compromised package, version 2.1.313, reached a meaningful audience. The extension's maintainer, Cursor, said that up to 5,000 users may have installed the malicious version, and the team temporarily shut down its own extension marketplace and rebuilt it while the incident was contained (Microsoft's Visual Studio Marketplace was not affected).
Technically the implant is small and deliberately unremarkable. The attackers prepended a 66-line immediately-invoked function to the extension's main extension.js file, so it executes silently the moment the extension loads, before any user interaction. The script adds an attacker-controlled SSH public key, filed under the innocuous label 'svc-telemetry', to the ~/.ssh/authorized_keys file. That single line is enough for full remote access to the machine from any host the attacker controls, with no password and no further exploit required.
Alongside the key, the payload opens a reverse SSH tunnel to the address 134.209.82.225, giving the operator a route into networks sitting behind the developer's machine. It then harvests basic environment intelligence: hostname, username and operating system, the developer's Git email, and the names of up to 40 environment variables that resemble keys or tokens, including AWS and GCP credentials. The values themselves were not copied in this version, but the names alone map out where the valuable secrets live.
Persistence is the part that matters most for incident response. The script installs an Apple LaunchAgent labelled com.apple.sysmond on macOS, a cron entry on Linux and a scheduled task on Windows. Because persistence is decoupled from the extension, uninstalling Claude Code removes nothing. The authorized key, the tunnel configuration and the scheduled mechanism all survive, so remediation means manually deleting the key from authorized_keys, inspecting LaunchAgents, cron tables and scheduled tasks, and rotating any credentials whose names appeared in the exfiltrated list.
IMPACT: For individual developers and small engineering teams the baseline has changed. Any extension installed from a community registry should now be treated as privileged code, because an extension runs with full user privileges on the very machine that holds the source code and the cloud credentials. The practical steps are concrete. Audit ~/.ssh/authorized_keys on macOS, Linux and Windows machines where this extension was installed between 29 and 30 October, remove unknown keys, review LaunchAgents, cron and scheduled tasks, and rotate Git, AWS and GCP secrets. Organizations with managed developer endpoints should push that audit centrally rather than rely on individuals. For compliance teams this is a supply chain event with an 11-hour exposure window that may need to be logged and, depending on what each affected machine held, reported. For the open source ecosystem, the conclusion is that registry review, signed builds and provenance attestation are no longer optional, because the cost of one malicious publish is a backdoor that outlives the software that carried it.
Sources: helpnetsecurity.com — phorion.io
Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky
Top comments (0)