Cyber ·
Claude Code extension for VS Code reportedly compromised on Open VSX, per a disclosure
A report on the oss-sec feed dated 30 October 2026 claims the official Claude Code extension on the Open VSX marketplace, used by VS Code-derived editors, may have been compromised. The claims are reported, not confirmed here.
According to a post by Valtteri Vuorikoski on the oss-sec feed, dated 30 October 2026, the official Claude Code extension for VS Code, available on the Open VSX marketplace, reportedly was compromised. That marketplace is used by editors derived from VS Code. The author says the extension is not open source and apologizes for posting an item outside the list scope, but argues that many open source maintainers use AI products and that this could serve as a compromise vector for those projects. The report says the Microsoft Visual Studio Marketplace was reportedly not affected. The text received is truncated, and the information is reported, not verified.
To consult the original, locate item 443 in the 2026 fourth-quarter oss-sec archive and check for vendor responses or updates to the notice. To verify the risk in your environment, review the publisher and version of the extension installed in your editor, and remove suspicious versions only following the vendor's official guidance.
Original source: Extensão Claude Code para VS Code, não open source, teria sido comprometida