Official Claude Code VS Code Extension Compromised with SSH Backdoor

The official Anthropic Claude Code extension on the Open VSX registry and Cursor Marketplace was compromised to secretly install a persistent SSH backdoor on infected developer hosts. This supply chain attack poses a critical threat to developers by compromising trusted AI coding tools, potentially granting attackers remote access to sensitive enterprise codebases and internal networks. The malicious payload specifically targeted builds distributed through Open VSX and the Cursor marketplace, while the build on the official Microsoft Visual Studio Marketplace remained unaffected.