HighMalicious packageupdated 30 Oct 2026, 12:31 UTC
Claude Code VS Code extension on Open VSX reportedly compromised
Attacks reported (oss-security)1 source, unconfirmed
| Severity | HighMalicious package |
|---|---|
| Being exploited? | ReportedBy oss-security, not officially confirmed yet |
| What to do | Remove itSee the steps below |
| How sure is this? | 1 source, unconfirmedOnly one publisher so far, details may change |
Timeline
- 30 Oct 2026, 12:18 UTCPublicly disclosed
- 30 Oct 2026, 12:18 UTCReported by oss-security · oss-security
- 30 Oct 2026, 12:31 UTCPicked up by Zero Radar
Sources 1 report, oldest first
Security researchers research teams and mailing lists
- Non-OSS: Claude Code for VS Code extension compromisedoss-security · 30 Oct 2026, 12:18 UTC
Technical details
- ID
- ZR-664b16a0
- Disclosed
- 30 Oct 2026, 12:18 UTC
- On Zero Radar
- 30 Oct 2026, 12:31 UTC (13 min after disclosure)
- Last change
- 30 Oct 2026, 12:31 UTC
This entry has not been explained yet. The text comes straight from the source. How Zero Radar works