A developer at a Makati software shop installs what the marketplace labels Claude Code for VS Code. It is late evening on 29 October 2026, inside an eleven-hour window nobody has announced yet. The publisher name is genuine, the namespace belongs to a real Anthropic employee, and no typosquat tell exists to catch. Before the version is pulled, that machine may hold an open reverse SSH tunnel to a stranger's server, and the National Privacy Commission's 72-hour clock may already be running (Source: Cursor, 2026; ASG, 2026).
Eleven Hours, Entirely After Hours
The malicious builds were Anthropic.claude-code 2.1.312 and 2.1.313, for Windows and macOS, and Anthropic did not develop either one (Source: Cursor, 2026). The window ran from 02:27 to 13:35 Pacific time on 29 October, which is 09:27 to 20:35 UTC (Source: StepSecurity, 2026). Cursor caps the affected population at 5,000 users (Source: Cursor, 2026).
Converted to Manila, the exposure sits between 17:27 on 29 October and 04:35 on 30 October. That is outside the working day for every Philippine engineering team, so recovery ran while affected code owners slept.
The Publisher Name Did Not Lie
The Anthropic namespace on Open VSX has been owned and published by an Anthropic employee since 2025, so 2.1.313 shipped under the legitimate publisher identity rather than a lookalike (Source: StepSecurity, 2026).
One upstream publish propagated automatically to every downstream consumer, and Cursor's marketplace serves the extension through that mirror (Source: StepSecurity, 2026).
How the build entered the registry has not been publicly established (Source: StepSecurity, 2026). Anthropic's Felix Rieseberg said on 30 October that the incident was not a compromise of Anthropic systems or employee laptops, and that official-channel versions were unaffected (Source: StepSecurity, 2026).
What the Payload Reached For
Cursor's notice lists the collection: hostname, username, operating system, architecture, home directory, the names of environment variables, working directories, configured Git email, and public IP (Source: Cursor, 2026).
The payload then appends an attacker SSH key to authorized_keys, enables local SSH, and opens a reverse tunnel that retries roughly every 60 seconds (Source: Cursor, 2026).
Persistence outlives removal. On macOS it installs a LaunchAgent; on Windows, a scheduled task running as a system account with a Startup-script fallback (Source: Cursor, 2026).
The code needs no editor APIs at all. The malicious extension.js runs under plain Node.js, so loading the module is enough, with no Claude conversation and no package-manager lifecycle hook required (Source: StepSecurity, 2026). That file was 3,692,922 bytes, about 7 KB larger than the preceding clean release (Source: StepSecurity, 2026).
Uninstalling Is Not the Fix
Cursor pulled the version, blocked distribution, audited access, rotated keys, and helped take the attacker server down (Source: Cursor, 2026). Open VSX now serves 2.1.312 and 2.1.314 and returns not-found for 2.1.313, while the Microsoft Marketplace returns 404 (Source: StepSecurity, 2026).
None of that cleans a host. The payload drops standalone persistence scripts that keep running after the extension is gone (Source: Cursor, 2026).
The named indicator is a key labelled svc-telemetry inside ~/.ssh/authorized_keys (Source: Cursor, 2026).
grep -qs svc-telemetry ~/.ssh/authorized_keys
The 72-Hour Clock Starts Inside authorized_keys
Under NPC Circular 16-03, a notifiable personal data breach goes to the National Privacy Commission and to affected data subjects within 72 hours of knowledge, with a full report inside five days unless the commission grants more time (Source: ASG, 2026).
NPC Advisory 2026-02, dated 11 May 2026, routes those notifications through the Data Breach Notification Management System and treats breaches touching the same data subjects and data elements as a single incident (Source: Baker McKenzie, 2026). One developer's authorized_keys entry can be the whole incident, depending on what that machine could reach.
Why the Blast Radius Grew
Philippine exposure is not abstract. The country logged 624,400 leaked user accounts in the first quarter of 2026, 21st globally and a 76.8 percent rise on the previous quarter, roughly five Filipino accounts every minute (Source: Interaksyon, 2026).
Lifetime, that is 155.6 million compromised accounts, second in Southeast Asia, with 79.1 million passwords exposed (Source: Interaksyon, 2026).
AI adoption is the accelerant. Corporate AI use climbed from 8.7 percent in 2023 to 20.2 percent in 2025 (Source: Interaksyon, 2026). Every added tool is another extension, publisher, and namespace an engineering team has decided to trust.
The working rule at Yano.AI is to treat an editor extension like any other dependency: pinned version, reviewable diff, named owner. The DICT National Cybersecurity Plan 2023-2028 points the same way, calling for documented breach reporting to the NPC (Source: DICT, 2023).
A Monday Morning Checklist
Ask three questions before the next install. Does the publisher namespace have a second factor you can verify, does the extension need filesystem access to do its job, and who would notice if its hash changed?
Then check hosts, not listings. Run the check everywhere and rotate any cloud key, Git token, or SSH key reachable from an affected shell (Source: Cursor, 2026).
FAQ
Q: Was this a fake extension with a similar name?
A: No. It used the real Anthropic namespace, which is why publisher-name checks did not catch it (Source: StepSecurity, 2026).
Q: Does uninstalling the extension remove the backdoor?
A: Not reliably. The payload drops persistence scripts that keep running after removal (Source: Cursor, 2026).
Q: Is an affected Philippine company required to notify the NPC?
A: If it meets the notifiable breach threshold, NPC Circular 16-03 requires notification within 72 hours of knowledge and a full report within five days (Source: ASG, 2026).
Key Takeaway
The number worth remembering is not 5,000. It is 7 KB, the gap between the clean release and the trojanized one (Source: StepSecurity, 2026).
A supply chain that verifies publishers and not artifacts keeps producing this event. The publisher was verified. The namespace was correct. The artifact was not.
So check the artifact, then check the host. Have you read authorized_keys on your own laptop this week, or are you still trusting a name?
Sources
- Claude Code extension security notice
- StepSecurity: Claude Code extension trojanized
- Philippines records 624,400 leaked accounts in Q1 2026
- Data breach notification deadlines in the Philippines
- Philippines data breach notification procedure further clarified
- DICT National Cybersecurity Plan 2023-2028
Sources — external references open in a new tab.