Zero Radar
← feed
CriticalMalicious packageupdated 30 Oct 2026, 10:28 UTC

Official Claude Code VS Code extension on Open VSX backdoored with SSH access

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityCriticalMalicious package
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doRemove itSee the steps below
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

Timeline

  1. 30 Oct 2026, 08:55 UTC
    Publicly disclosed
  2. 30 Oct 2026, 08:55 UTC
    Reported by The Hacker News · The Hacker News
  3. 30 Oct 2026, 10:28 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-ad2cc061
Disclosed
30 Oct 2026, 08:55 UTC
On Zero Radar
30 Oct 2026, 10:28 UTC (2 h after disclosure)
Last change
30 Oct 2026, 10:28 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Official Claude Code VS Code extension on Open VSX backdoored with SSH access · Zero Radar