{"data":{"id":"dd3ab6a8-69c4-4b98-95f6-4939d079ccd5","title":"Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor","summary":"A trojanized update, version 2.1.313, of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate extension ID anthropic.claude-code. The malicious code adds an attacker-controlled SSH key to ~/.ssh/authorized_keys, sets up a reverse tunnel and persistence, and sends host reconnaissance data to 134.209.82[.]225:8099/beacon. Anthropic has since published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.","solution":"Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace, and the malicious version has been removed. The source also says to follow the remediation steps in its analysis, but those steps are not included in the text provided.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html","publishedAt":"2026-10-30T08:55:47.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","Cursor","Grok"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-30T08:55:47.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"]}}