Claude Code extension poisoned with persistent SSH backdoor

Reported by Help Net Security (Sinisa Markovic)

Summary by Cyber Security News30 Oct 2026, 12:15 CET

About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/

A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The malicious package, version 2.1.313, was published on Open VSX, an open-source marketplace for VS Code extensions run by the Eclipse Foundation. VS Code’s default extension store is Microsoft’s Visual Studio Marketplace, which never carried the compromised extension.

Read the full article at Help Net Security →