Claude Code VS Code Extension Version 2.1.313 Implanted with Backdoor, Can Remotely Control Computers

Techub News reports that cybersecurity researcher OpenSourceMalware discovered that the Claude Code extension version 2.1.313 was implanted with a hidden backdoor allowing attackers to remotely access infected computers. This malicious version exists in the Open VSX extension registry, appearing identical in appearance and functionality to the legitimate version, but it automatically runs malicious code upon loading, attempting to connect to an attacker-controlled server and remains active even after rebooting. Researchers noted that while the attack is not specifically targeting cryptocurrency users, computers engaged in blockchain project development may store sensitive information such as private keys, wallet credentials, and exchange API keys. Remote access could potentially lead to damage to assets or projects. Currently, no cryptocurrency theft has been confirmed, and no malicious code with specific blockchain functionality has been found. Researchers confirmed the presence of malicious code in the Open VSX version but cannot determine how it was introduced. The investigation has not proven that the official Anthropic VS Code Marketplace version or its distribution system was compromised. Users who installed this version should consider their systems potentially infected, and merely removing the extension may be insufficient. (U.Today)