According to U.Today, a malicious Claude Code extension hosted on Open VSX contained a hidden backdoor that could affect developers using the extension in their VS Code environment. The extension allowed integration with Claude for code assistance but included unauthorized functionality that posed security risks to users’ machines. The version of the extension in question was distributed through Open VSX, which serves as a platform for open source VS Code extensions. Because the backdoor was embedded within the extension itself, developers who installed and used the extension via VS Code may have been exposed without awareness. No details were provided about how the backdoor operated, when it was introduced, or which specific actions it enabled. The issue pertains only to this particular version of the extension; other versions or alternative extensions were not mentioned. Researchers or security analysts did not confirm widespread deployment or active exploitation. The finding suggests that reliance on third‑party extensions from Open VSX requires careful verification, especially for cryptographic development work.
