[BUG] Open VSX has marked vs code extension as malicious causing VS code forks using Open VSX to uninstall the extension automatically

[erikolofsson]

See discussion at:
EclipseFdn/publish-extensions#945

It seems unclear if the extension that was previously published on openvsx was published by Anthropic or not.

As this has security implications for users it would be good if an up to date version of the extension is published to Open VSX as part of your release workflow.

[kineticsquid]

@erikolofsson Thanks, we received a report to our security channel that the Anthropic.claude-code extension published at open-vsx.org was malware. Could we hear from then Anthropic team?

[github-actions]

Found 2 possible duplicate issues:

1. VSCodium Integration Fails: Extension Not Detected on Debian 12 #5698
2. [Feature Request] Host .vsix file for Claude Code VSCode extension on Github? #1246

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[kineticsquid]

@igorkofman?

[igorkofman]

Hi folks. The extension is not malware. Please let me know any concerns that were reported.

Igor (igor@anthropic.com)

[igorkofman]

Happy to update it (though the last published version is fine). I no longer see the namespace in my open-vsx account.

[igorkofman]

[kineticsquid]

@igorkofman Sorry about that. We've had a spate of malware over the past month or so and this got caught up in that. I've added you back as owner of the Anthropic namespace. Don't add the extension yet, I need to submit a PR to have it removed from the malicious list. I'll comment here once I see it's been removed from that list.

[igorkofman]

Thanks, standing by.

…

On Thu, Aug 14, 2025 at 7:53 AM John Kellerman ***@***.***> wrote: *kineticsquid* left a comment (anthropics/claude-code#5762) <#5762 (comment)> @igorkofman <https://github.com/igorkofman> Sorry about that. We've had a spate of malware over the past month or so and this got caught up in that. I've added you back as owner of the Anthropic namespace. Don't add the extension yet, I need to submit a PR to have it removed from the malicious list. I'll comment here once I see it's been removed from that list. — Reply to this email directly, view it on GitHub <#5762 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADSWQSIXBJEHKHSTQFUJCD3NSPFBAVCNFSM6AAAAACD4SREGKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCOBYG42TAMJUGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[kineticsquid]

OK, you're good to go: https://github.com/EclipseFdn/publish-extensions/blob/master/extension-control/extensions.json