Trojanized Claude Code extension on Open VSX installs an SSH backdoor
Original title: Malicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote Access
Version 2.1.313 beacons to 134.209.82.225 and plants an Ed25519 key; Anthropic’s Microsoft Marketplace build is not implicated.
Researchers analyzed anthropic.claude-code version 2.1.313 from Open VSX and found 66 lines of JavaScript added to the legitimate bundle. The loader runs when VS Code loads extension.js, collects host and credential-related environment names, and appends an attacker Ed25519 key marked svc-telemetry to authorized_keys. It tries to enable SSH and maintain reverse tunnels, with persistence via a macOS LaunchAgent, Linux crontab, or Windows scheduled task. There is no stated evidence that Anthropic’s official Microsoft Marketplace distribution was compromised.
Unconfirmed: It is unconfirmed how the malicious version entered the publishing chain.
- The malicious artifact is anthropic.claude-code version 2.1.313 obtained from Open VSX.
- Execution starts at extension load and does not require a Claude conversation.
- Reconnaissance covers hostname, user, OS, Git email, and up to 40 variable names.
- The C2 address is 134.209.82.225, using SSH port 22 and HTTP port 8099.
- How the build entered the publishing chain is not explained.
Impact: Persistent SSH access and host and credential-name reconnaissance
| Product | Affected |
|---|---|
| Anthropic Claude Code VS Code extension | anthropic.claude-code 2.1.313 on Open VSX |
- 1.Isolate affected hosts and block 134.209.82.225 on ports 22 and 8099.
- 2.Inspect authorized_keys, persistence locations, and reverse-forwarding SSH processes.
- 3.Rotate exposed credentials from a clean system and rebuild affected hosts.
- ATT&CK
- T1098.004 SSH Authorized KeysT1021.004 SSHT1053.003 CronT1053.005 Scheduled TaskT1543.001 Launch Agent
- Vendors
- Anthropic
- Products
- Claude CodeVS Code
- AI models
- Claude
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.82.225 | . IoC Type Indicator Extension [email protected] C2 address 134.209.82[.]225 Network ports SSH 22 ; HTTP 8099 Remote beacon hxxp://134 |
| sha256 | 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 | cfea06be5fb2ab183e8ecc3ab6bf15 Embedded private-key SHA-256 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 Note : IP addresses and domains are intentionally defanged |
| sha256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | d ; .config\smtk ; SysMon ; sysmon.cmd extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 Embedded private-key SHA-256 7e0a52885fadee05544a9e99eb18c7 |
| url | http://127.0.0.1:8099/beacon | ote beacon hxxp://134.209.82[.]225:8099/beacon Local beacon hxxp://127.0.0.1:8099/beacon SSH marker svc-telemetry SSH fingerprint SHA256:0Z6R+DF64Do |
| url | http://134.209.82.225:8099/beacon | 209.82[.]225 Network ports SSH 22 ; HTTP 8099 Remote beacon hxxp://134.209.82[.]225:8099/beacon Local beacon hxxp://127.0.0.1:8099/beacon SSH marker svc- |
From the original article
3 min read at gbhackers.com
A trojanized version of the Claude Code extension, identified as anthropic. claude-code version 2. 1.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.