Cybersecurity researchers discovered that version 2.1.313 of the Claude Code extension published on the Open VSX registry contained a hidden backdoor. The malicious code ran automatically when the extension loaded, attempted to connect to an attacker-controlled server and was designed to survive a computer restart. Although the attack did not specifically target cryptocurrency users, developers working on blockchain projects risked having their private keys, wallet credentials, exchange API keys and access to crypto infrastructure compromised. Researchers did not, however, confirm any cryptocurrency theft or identify blockchain-specific functionality in the malicious code. The findings do not prove that Anthropic’s official release on the VS Code Marketplace was compromised, but users who installed version 2.1.313 through Open VSX should treat their systems as potentially compromised, as removing the extension may not be sufficient to eliminate the malware’s persistence.
Source: Read the original article
