Posted by _chall 1 day ago
it looks like anthropic folks in this thread are throwing excuses instead of allocating one оr two FTE to make sure this will not happen
Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.
It’s good fun building for retro-like machines.
Running NixOS helps.
> No review system at anthropic has seen this
Weird flex
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.
At a minimum they should monitor the larger marketplaces even if they're not in the chain.
(This is a joke, to be clear.)
Good that you said so, this is annoyingly plausible.
Sums up my feelings of the last few years nicely.
Here’s a complete rundown of what happened—load-bearing parts first:
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.This could have been avoided by having extensions signed by company doing them with keys and review
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.
Binance got a pretty expensive lesson if that was the cause for their recent hack
Why risk getting compromised like that?
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
https://github.com/eclipse-openvsx/openvsx/wiki/Trusted-Publ...
Edit: Ah, guess it was not open-vsx, but a in-house Cursor marketplace. https://news.ycombinator.com/item?id=50304129
Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"
Vibecoders are safu
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.
An official announcement from Anthropic would be nice!
I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.
It tells you all you need to know about how unserious these people are about computer security.
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
> The open challenge is how to prove it!
Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front.
[1] https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55...
[2] https://x.com/bcherny/status/2086520950259118464
[3] https://embracethered.com/blog/posts/2026/breaking-claude-co...
Or, is this FUD?
It also sounds like only cursor marketplace is affected, not vscode proper.
It may be the cause, but zero excuse.
How could Anthropic have known, they only claim to harbour superintelligence.
/s
It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.
"The Microsoft VSCode extension for Claude is NOT malicious"
"The Microsoft VSCode extension for Claude is NOT malicious"
https://opensourcemalware.com/blog/trojanized-claude-code-ex...
why are you spewing straight up lies?
"The Microsoft VSCode extension for Claude is NOT malicious"
dang should change the title and/or merge this submission with the other one. [1] This is causing needless panic for a typosquatting-style "attack" unrelated to official Anthropic extensions.
Two out of the three links in the post still say exactly that.
That’s also what the majority of the comments here are saying, likely because they read the first two.
Is that your “nobody”?