Malicious Claude Code Extension Targets 5,000 Developers with SSH Backdoor

A malicious version of the Claude Code extension was published to a trusted VS Code marketplace and served for nearly 11 hours, putting 5,000 developers at risk of a persistent SSH backdoor. The malware was hidden in a JavaScript loader that executed immediately without requiring any user interaction.

A malicious version of the popular Claude Code extension was compromised, putting 5,000 developers at risk of a persistent SSH backdoor malware that was served from a trusted VS Code marketplace for nearly 11 hours. The sneaky malware was cleverly hidden in a JavaScript loader, allowing it to execute immediately without requiring any user interaction.