Comment by K0nserv
1 day ago
Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
You make a good point, my comment above probably overstates things.
There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
>Also, all their tags are immutable, and so can't just be deleted to hide things
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
You’re right, I read too quickly.
1 reply →