A tampered build of Anthropic’s Claude Code add-on lingered in an open extension marketplace for roughly eleven hours, and on a Mac it left a startup item posing as part of the operating system’s plumbing. The package arrived on Open VSX, the Eclipse Foundation’s alternative store for editors built on the VS Code codebase, including Cursor.
What ran before anyone clicked
Versions 2.1.312 and 2.1.313 carried a block of code bolted onto the front of the extension bundle. Phorion chief executive Calum Hall, who walked through the findings, found it fires the moment Node loads the file, before any startup routine.
The injected section pulls in Node libraries for process control, filesystem work and outbound networking. Automation on the developer’s machine then gains a second way in, because a new public credential lands in that account’s authorised keys list. An outbound tunnel follows, retrying near once a minute and outlasting the editor window.
A startup file with an official-sounding name
Persistence is tailored per platform. On macOS the malware drops a launch item styled like an Apple component, so it loads at login without attention. Linux gets a cron entry, and Windows a scheduled task named SysMon, though the added credential only helps where remote shell access runs.
An inventory of secrets, not the secrets themselves
A profile of the host travels out with every check-in: machine name, account, home folder, public address, and a reckoning of as many as 40 variables whose labels suggest cloud tokens. Contents are never taken, yet the inventory points an intruder at valuable hosts.
Nothing hostile turned up on Microsoft’s own extension store, which restricts itself to Microsoft products. Anyone who touched an affected build on a Mac should assume compromise, clear the startup entry and replace exposed secrets, not just delete the add-on.
