Anthropic's Claude Code VS Code extension was replaced with a build that installs a persistent SSH backdoor

The Hacker News reports that cybersecurity researchers disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts. This is a supply-chain compromise of a widely used developer tool: the package carrying the Claude Code name was the vehicle, and the payload was a mechanism for persistent remote access over SSH.

Help Net Security reports that a tampered build of Anthropic's Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers' machines, and that this was found by researchers at the macOS security firm Phorion. Help Net Security says the malicious package was version 2.1.313 and that it was published on Open VSX, which it describes as an open-source marketplace for VS Code extensions. That version number is the single most useful indicator a defender has: it identifies the specific build that carried the backdoor.

BleepingComputer reports that a malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, and that this exposed up to 5,000 developers to malware designed to install persistent SSH backdoors. The window was short in calendar terms but long enough, on BleepingComputer's figure, to reach a large population of developer workstations.

The Hacker News reports that the issue has since been traced to the compromise of the Cursor Marketplace, and that this prompted the AI coding platform Cursor to briefly take action. The two distribution points named across the reporting are therefore Open VSX, named by Help Net Security, and Cursor's marketplace, named by BleepingComputer and tied to the root cause by The Hacker News.

What this touches. The affected software is Anthropic's Claude Code extension, specifically the build Help Net Security identifies as version 2.1.313. The affected platforms are VS Code-compatible editors, which Help Net Security names as the environment the extension targets, and Cursor, which BleepingComputer names as the marketplace that distributed the malicious build. The affected registries are Open VSX and the Cursor Marketplace. The affected population, on BleepingComputer's figure, is up to 5,000 developers who were exposed during the roughly 11-hour window on October 29.

What to do about it. Match your estate against the facts the vendors and researchers have listed rather than assuming the version number alone. Inventory every machine running the Claude Code extension in a VS Code-compatible editor, including Cursor, and check the installed extension version against the 2.1.313 build that Help Net Security identifies as malicious. Because the reported payload is a persistent SSH backdoor, removing the extension is not sufficient on a host that ran it: a backdoor installed through the extension survives the extension's removal. Treat any machine that ran the identified build as a host where SSH access requires review.

For those hosts, review the SSH configuration and the authorized_keys files for the user accounts and for root, looking for keys and configuration entries you did not add. Review SSH service state and any persistence that would restart a listener or re-add a key. Because the exposure window on BleepingComputer's account is October 29, correlate your review with activity from that date forward.

The reporting does not name a fixed version to upgrade to, so do not treat reinstalling the extension as remediation on an exposed host until you have confirmed the SSH state of that machine. The Hacker News reports that Cursor took action in response; monitor the researchers at Phorion and the three outlets named here for a confirmed clean build and for published indicators of compromise before restoring the extension on affected systems.