Malicious Claude Code extension on Open VSX plants an SSH backdoor
Original title: Weaponized Claude Code Extension Gives Hackers Persistent Remote Access to Developer Systems
OpenSourceMalware says anthropic.claude-code 2.1.313 adds an SSH key, reverse tunnel, and startup scripts; Anthropic’s official release is not shown compromised.
OpenSourceMalware reported on October 30 that a tampered Claude Code package on Open VSX, anthropic.claude-code version 2.1.313, can give persistent remote access to developer systems. A 66-line JavaScript loader at the start of extension.js runs when the extension loads, without a Claude conversation. The sample analyzed targeted macOS on Apple Silicon and also contains Linux and Windows code paths. How the package was altered is unknown, and the findings do not show a compromise of Anthropic’s official Visual Studio Marketplace release.
Unconfirmed: How the package was altered is unknown, and a compromise of Anthropic’s official marketplace release is not shown.
- The loader adds an Ed25519 key commented svc-telemetry to authorized_keys.
- It opens a reverse SSH tunnel to tunnel@134.209.82.225 and beacons over HTTP on port 8099.
- macOS persistence uses a user LaunchAgent named com.apple.sysmond.plist; Linux uses an @reboot cron entry.
- The beacon collects hostname, username, OS, Git email, and names of up to 40 environment variables.
- Uninstalling the extension alone does not show the host is clean.
Impact: Persistent SSH access and host telemetry from developer machines
| Product | Affected |
|---|---|
| anthropic.claude-code | 2.1.313 on Open VSX |
- 1.Inspect authorized_keys for svc-telemetry and search for the named persistence files.
- 2.If the extension ran, isolate the host and block 134.209.82.225 on ports 22 and 8099.
- 3.Rotate exposed credentials from a clean device and review authentication and network logs.
- ATT&CK
- T1098.004 SSH Authorized KeysT1572 Protocol TunnelingT1543.001 Launch AgentT1053.003 CronT1071.001 Web Protocols
- Vendors
- Anthropic
- Products
- Claude CodeOpen VSX
- Organizations
- OpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.82.225 | into a temporary .stk_ file. The malware connects to tunnel@134.209.82.225 and requests reverse forwarding to localhost port 22. This |
From the original article
3 min read at cybersecuritynews.com
A weaponized Claude Code extension found on Open VSX can give attackers persistent remote access to developer systems by planting an SSH key, opening a reverse tunnel, and installing startup scripts. OpenSourceMalware identified the tampered package as anthropic. claude-code version 2.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.