Crypto Developers Using Claude Via VS Code May Have Been Compromised: This Version Has a Backdoor
A malicious version of Anthropic's Claude Code extension for Visual Studio Code contained a backdoor that could give attackers remote access to infected computers, cybersecurity researchers have discovered.
The compromised extension, discovered by OpenSourceMalware researchers on October 30, appeared identical to the legitimate Claude Code tool but contained hidden malicious code that activated automatically when loaded. This backdoor attempted to establish connections to attacker-controlled servers, potentially granting hackers full access to victims' systems.
The malware was specifically designed to remain active even after computer restarts, meaning simply closing VS Code might not eliminate the threat. While not specifically targeting cryptocurrency users, developers working on blockchain projects face significant risks as their computers often contain sensitive private keys, wallet credentials, and exchange API keys.
Persistent Threat
If attackers successfully gained remote access, they could potentially obtain sensitive information and use it to compromise wallets or cryptocurrency projects. Researchers confirmed malicious code in the Open VSX version but could not determine how it was introduced.
The findings do not prove that Anthropic's official VS Code Marketplace release or its broader distribution systems were compromised.
Immediate Action Required
Developers who installed version 2.1.313 through Open VSX should treat their systems as potentially compromised and investigate immediately. Removing the extension alone may not be sufficient, as the backdoor was designed to persist independently.
Related
