Malicious code detected in Claude Code extension for VS Code 2.1.313

CoinDesk reported that cybersecurity researchers have found a hidden backdoor in a Claude AI extension for Visual Studio Code, potentially exposing developers to a serious security threat. OpenSourceMalware said in an October 30 report that version 2.1.313 of the Claude Code extension contains malicious code that could give attackers remote access to infected machines. The compromised version was found in the Open VSX extension registry, a source developers use to download tools for their coding environments. The extension appears and functions like the legitimate Claude Code tool, making the threat hard to detect. Researchers found additional malicious code that runs automatically when the extension loads. Once activated, the backdoor tries to connect to an attacker-controlled server and may give hackers access to the victim computer. The malware is designed to remain active after a restart, so closing VS Code or stopping use of Claude does not eliminate the risk. The attack was not specifically aimed at cryptocurrency users, but blockchain project developers may face significant exposure. Their computers can hold private keys, wallet credentials, exchange API keys and access to cryptographic infrastructure. Remote access could allow an attacker to obtain such information and compromise wallets or projects. Researchers confirmed malicious code in the Open VSX version they analyzed but could not determine how it was inserted. The findings do not prove that the official Anthropic release on the VS Code Marketplace, or its broader distribution system, was compromised. Developers who installed version 2.1.313 through Open VSX should treat their systems as potentially compromised and start an investigation immediately. Removing the extension may not be sufficient because the backdoor is designed to persist independently.