Anthropic's Claude Code Extension Found to Carry Persistent SSH Backdoor After Marketplace Breach

Security researchers have confirmed that the official Claude Code extension for Visual Studio Code, published through the Open VSX registry, was altered to embed a persistent SSH backdoor on machines where it is installed. The malicious payload activates automatically after the extension is loaded, granting remote command‑line access to an unauthenticated attacker.

The investigation, first reported by The Hacker News, revealed that the backdoor creates a hidden SSH key pair and modifies the host's authorized_keys file, allowing persistent entry even after the extension is removed. The researchers stress that the code runs with the same privileges as the user who installed the extension, making it especially dangerous for developers who often operate with elevated rights.

Extensions for VS Code are typically distributed through open registries such as Open VSX, which aim to provide a decentralized alternative to the official Microsoft Marketplace. While these registries increase accessibility, they also broaden the attack surface for supply‑chain compromises. In this case, the malicious version of Claude Code appeared identical to the legitimate package, evading casual inspection and automated scans that focus on binary signatures.

Further analysis traced the intrusion back to the Cursor Marketplace, a platform that hosts third‑party tools for the Cursor code editor. The compromise appears to have originated there, with attackers injecting malicious code into the Claude Code package before it was mirrored to Open VSX. This chain of events underscores how a breach in one ecosystem can cascade into others that share artifacts.

Anthropic has issued a statement acknowledging the breach and has removed the compromised package from all distribution channels. The company advises users to uninstall the extension immediately, delete any newly created SSH keys, and rotate credentials on affected systems. The VS Code community is also urged to verify extensions against official sources and to enable security extensions that monitor for unexpected network activity.

Supply‑chain attacks on developer tools have risen sharply in recent years, with high‑profile incidents targeting package managers for languages such as JavaScript and Python. This latest episode highlights the need for stronger provenance verification, automated integrity checks, and coordinated response mechanisms across open‑source registries. Analysts predict that heightened scrutiny of extension ecosystems will become a priority for both platform maintainers and security teams moving forward.