Security researcher OpenSourceMalware said version 2.1.313 of the Claude Code extension was found with a hidden backdoor that could give attackers remote access to infected computers. The malicious build was identified in the Open VSX extension registry and reportedly looked and behaved like the legitimate release, but executed malicious code on load, attempted to connect to an attacker-controlled server, and remained active after a reboot. Researchers said the campaign did not appear to specifically target crypto users, but machines used for blockchain development may store sensitive material such as private keys, wallet credentials, and exchange API keys, creating a risk of asset loss or project damage if remote access is obtained. So far, no cryptocurrency theft has been confirmed, and the malicious code has not been found to include blockchain-specific functions. OpenSourceMalware confirmed the malicious code in the Open VSX version, but said it could not determine how it was introduced. The investigation also did not show that Anthropic’s official VS Code Marketplace version or its distribution system had been compromised. Users who installed the affected version were advised to treat their systems as potentially compromised, as removing the extension alone may not be enough.
Techub News reported that security researcher OpenSourceMalware found a hidden backdoor in version 2.1.313 of the Claude Code extension, which could allow attackers to remotely access infected computers.
The malicious version was present in the Open VSX extension registry. Researchers said it looked and functioned like the legitimate release, but automatically executed malicious code when loaded, attempted to connect to an attacker-controlled server, and stayed active after a reboot.
Blockchain development machines may hold sensitive data
According to the researchers, the attack did not appear to specifically target cryptocurrency users. Even so, computers used in blockchain development may contain private keys, wallet credentials, exchange API keys, and other sensitive information. If those systems are accessed remotely, assets or projects could be damaged.
No cryptocurrency theft has been confirmed so far, and researchers said they have not found blockchain-specific functions in the malicious code.
Entry point remains unclear
The researchers confirmed the malicious code in the Open VSX version, but said they could not determine how it was introduced. Their investigation also did not establish that Anthropic’s official VS Code Marketplace version or its distribution system had been compromised.
Users who installed version 2.1.313 were advised to treat their systems as potentially compromised, as removing the extension alone may not be sufficient.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
