[REVISION HISTORY]

Claude Code extension supply chain attack

1 recorded revision of this situation.

What changed

2026-10-30 19:26 UTC → 2026-10-31 11:43 UTC · added ~~removed~~

A malicious version of the Claude Code VS Code extension, specifically version 2.1.313, was identified as part of a supply chain attack. The trojanized version contained a 66-line loader that executed automatically to collect system information, including hostnames, usernames, OS architecture, and Git email addresses. It also inventoried up to 40 environment ~~variables~~ variable names related to sensitive credentials like AWS and GCP. To establish persistent access, the malware appended an SSH public key labeled “svc-telemetry” to the user’s authorized_keys file and attempted to establish reverse SSH ~~tunnels.~~ tunnels to the IP address 134.209.82.225. On macOS, the malware attempted to maintain persistence by disguising itself as a LaunchAgent named “com.apple.sysmond”. Reports indicate the malicious package was available on the Open VSX registry via an account associated with an Anthropic employee. Additionally, the compromise affected the Cursor AI coding editor marketplace, where the tampered extension was available for approximately 11 hours on October 29. Cursor reported that at most 5,000 users were affected. While flaws in the malware prevented successful SSH tunneling on many systems without administrator privileges, it could still collect data and install unauthorized SSH keys. Cursor has since removed the ~~package and rebuilt~~ package, temporarily shut down its ~~marketplace.~~ marketplace, and rotated keys. Anthropic clarified that its official distribution channels and systems were not breached, and the incident was limited to users who downloaded the specific version through the affected marketplaces. The legitimate Claude Code extension has since been updated to version 2.1.314.

Versions

Select a version to see what changed compared to the one before it.