A malicious build of the Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry with a 66-line loader prepended to extension.js, executing at VS Code startup before the legitimate code. The implant adds an Ed25519 key labeled svc-telemetry to authorized_keys, enables SSH, opens a reverse tunnel to 134.209.82.225, and persists via LaunchAgent, cron, or scheduled task. It beacons host reconnaissance over HTTP port 8099 but downloads no further payloads. The author attributes the Open VSX listing to Anthropic employee Igor Kofman and says compromise cause, attacker identity, and official Marketplace status remain unverified.

AI summary of the linked source — not editorial content.

Story signal · how it spread on X · via Elfa

as of

Claude · a product of Anthropic · source

Spread
i
Distinct X and Telegram accounts Elfa counted behind this story’s reports, summed over the thread. Not posts, not impressions.
7 accounts

first post
Leviathan +3 h later

ANTHROPIC reaction
i
Price change from the first post to 24 hours later (Hyperliquid). BTC over the same window is shown so a market-wide move is not mistaken for a reaction to this story. Not advice.
−0.4% 24h after post

$1,794 → $1,788
BTC +0.3% same window

Thread · 1 event
  1. First reportCompromised Claude Code extension reportedly exposed users to an SSH backdoor7 acc.
  2. Leviathan published this article

All times UTC.

Cited posts

  • @mattjay Matt JohansenFirst reportOn X ↗

    The official Claude code VS Code extension was compromised and pulling it would’ve installed an ssh backdoor on your machine for a brief window today.https://t.co/NHuloOo4t4

  • @AGTPinsights AGTPOn X ↗

    Anthropic's official Claude Code VS Code extension was compromised today. Here's what you need to know. Matt Johansen posted that the official extension was hit, and that pulling it would have installed an SSH backdoor on your machine for a brief window today. His post has about… https://t.co/UaHk9Qz0RQ

  • @TimJayas Tim JayasOn X ↗

    🚨 official Claude Code VS code extension is compromised if you're on a VS code fork that pulls from Cursor, Windsurf, VSCodium and have updated to version 2.1.313 you much be cautious here's how you can check: run this on your terminal code --list-extensions --show-versions…

Show 1 more cited post
  • @m4rio_eth m4rioOn X ↗

    Cloud Code OpenVSX extension was backdored today, you heard me right yes. Claude VS Code extension was compromised

3 more accounts posted about this · 3 Telegram channels (no public link)

TradersTrader calls tracked by Elfa · not advice

Whole crypto market, not this story

Crowding0th percentile · vs last 28 days, 50 typical
Pulse 24h99/100 · unusualness of new calls, 0–100, 50 typical, higher means more long than usual
Book97.0% long · 10,757 accounts

As of 30 Oct 07:25 UTC.

Social-monitoring data, not investment advice Elfa prices Hyperliquid post text from Xas of

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…