Same Version, Three Files: Auditing the Claude Code Extension Backdoor Against Both Public Registries

Sat, 31 Oct 2026 00:00:00 +0000

On 29 October 2026, for eleven hours and eight minutes, Anthropic.claude-code was a backdoor. Not a lookalike name, not a typo-squatted publisher, not a cIaude-code with a capital i — the real identifier, the real publisher namespace, and version numbers that matched a real release line: 2.1.312 and 2.1.313. The bundle it served contained an immediately-invoked function that wrote an attacker’s SSH key into ~/.ssh/authorized_keys, opened a reverse tunnel to 134.209.82[.]225, and installed reboot-surviving persistence on macOS, Linux and Windows.

Every write-up of this incident so far has had to open with a caveat, because the central question — was the official extension compromised, or only the mirror? — was answered by competing press releases. Anthropic’s engineers said the official channels were clean. Commenters pointed out that Cursor mirrors Open VSX, so “clean upstream” was doing a lot of work in that sentence. Security Boulevard and a Binance-hosted syndication of ChainCatcher both claimed the malicious build had been published to Open VSX. One Hacker News thread carried 435 comments across 78 top-level threads and never settled it.

Cursor Marketplace on SoloSoft

Same Version, Three Files: Auditing the Claude Code Extension Backdoor Against Both Public Registries