Official Claude Code VS Code Extension Compromised
The official Claude Code extension for VS Code was compromised; for a short period, installing it could leave an SSH backdoor on a user’s computer.
The official Claude Code extension for VS Code was compromised. For a short period, installing it could leave an SSH backdoor on the computer.
Why it matters
AnalysisA compromised official extension can silently expose SSH keys, tokens, and infrastructure access, which is especially risky for developers working with AI coding tools.
Discuss in community
Share your questions and insights with developers
Related in Ecosystem
Practical guides, core terminology, and agent skills
Claude Code adds variable to disable dangerous-command protections
Claude Code now includes an environment variable that can bypass even the safety blocks that remained active with --dangerously-skip-permissions.
Hackers can hijack Codex and Claude Code via malicious files in the Downloads folder
A plain text file in ~/Downloads can trick AI coding agents into changing settings, installing malware, or leaking authorization tokens, according to Forever Security.
Claude Code Projects: How a Single AI Orchestrates a Team of Autonomous Agents
A deep dive into Claude Code Projects: Coordinator and Threads architecture, parallel branches, shared memory via MEMORY.md, and cloud agent management.
MCP Servers and Claude Code: A Practical Guide to Connecting and Building
How to expand Claude Code's capabilities with Model Context Protocol: connecting the filesystem, GitHub, PostgreSQL, Brave Search, and developing a custom server in TypeScript.