Researchers have uncovered a serious supply-chain attack involving the official Claude Code extension for Visual Studio Code. A compromised version of the extension was used to plant a persistent SSH backdoor on user systems. This malicious update was live on both Open VSX and the Microsoft VS Code Marketplace until it was swiftly removed. The vendor has since released a patched version.
What was compromised and how it worked
The problematic version—tagged anthropic.claude-code v2.1.313—contained a hidden 66-line loader embedded before the legit extension code. Upon launching VS Code and triggering the extension’s web view, the loader added an attacker-controlled SSH key to the user’s ~/.ssh/authorized_keys, disguising it under the name “svc-telemetry” to avoid suspicion.
Once the key was added, the malware set up a reverse SSH tunnel to the external IP 134.209.82.225 and attempted to enable SSH access across Windows, Linux, and macOS. It also installed persistent mechanisms—scheduled tasks, crontabs, and LaunchAgents—and transmitted environment and system information, including hostname, username, OS details, certain Git configs, and names of environment variables tied to cloud secrets. All of this occurred over unencrypted HTTP.
Who was impacted and what’s known so far
An initial estimate puts the number of affected users at no more than 5,000. The window of exposure goes from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, 2026, during which the malicious build was automatically pushed. Users with auto-update enabled may have received the compromised version without manual action.
While the SSH enabling part requires administrator-level privileges—generally unavailable on Windows and macOS for typical users—users on Linux may have been more vulnerable. Even where full SSH wasn’t enabled, the extension still added the key, installed persistence tools, and sent sensitive system metadata.
What to do if you were affected
Immediately isolate any machine suspected of housing the compromised extension. Remove the unauthorized SSH key labeled “svc-telemetry” from ~/.ssh/authorized_keys. Undo persistence mechanisms—delete any scheduled tasks, crontabs, or LaunchAgents introduced by the malware. Finally, rotate any credentials, close and reopen sessions, and monitor for signs of misuse.
The issue was addressed the same day the illicit update was discovered. The extension was pulled from both marketplaces and replaced with version 2.1.314. How the attacker inserted the malicious loader remains unclear at this time.
This breach follows closely on the heels of another supply-chain attack in which attackers replaced official OVHcloud CLI releases with malware in an operation tied to a compromised GitHub contributor account.
Why this matters: extensions like Claude Code are powerful developer tools trusted to augment workflows. A breach here undermines trust in software infrastructure and highlights how a single compromised component can expose user systems to deep intrusion. For organizations and individuals alike, this should prompt scrutiny of extension usage policies, registry of trusted sources, and strict control over auto-updates. In supply-chain security, vigilance is the only defense.
