A poisoned copy of Anthropic’s Claude Code extension reached developers through Open VSX, the Eclipse Foundation’s open marketplace that editors like Cursor and Windsurf depend on because Microsoft’s Visual Studio Marketplace is closed to them.
Phorion, a macOS security firm, found version 2.1.313 of the extension carrying an injected immediately invoked function expression bolted onto the front of the minified bundle. Everything after that prefix looks ordinary: Claude Code strings, working activate and deactivate exports, the usual interface code.
The prefix is what matters. It loads Node’s child_process, fs, os, path, http and crypto modules and runs the moment Node parses the file, before the extension’s activate callback fires. Nobody has to click anything.
Once live, the code appends the operator’s SSH key to the user’s authorized_keys file, opening an inbound login path. It then dials out to a command server and holds a tunnel open, retrying about every 60 seconds and surviving the editor being shut.
Persistence is platform-specific. On a Mac it writes a startup file under an Apple-style name. On Linux it adds a cron entry that fires at reboot. On Windows it tries to register a scheduled task called SysMon and falls back to the Startup folder. Each beacon reports the hostname and other machine details back to the operator.
Microsoft’s own store carried no malicious build, and Anthropic has published no notice of its own on the marketplace listing.
The exposure runs through how these editors source add-ons. Developers who install VS Code-compatible tooling outside Microsoft’s ecosystem trust whichever registry their editor points at, and that registry verifies far less than a first-party store. Anyone running the extension should check the installed version, inspect authorized_keys for unrecognized keys, and look for the SysMon task or startup entry.
