The original text is in EN, taken from the source site. Source ↗

A trojanized version of the Claude Code extension, identified as anthropic.claude-code version 2.1.313, contains a malicious loader that enables persistent SSH access to developer systems.

Researchers analyzed an artifact obtained from Open VSX and discovered 66 lines of JavaScript added to the legitimate extension bundle. This additional code lets the attacker’s script run before the normal initialization process.

The findings confirm malicious behavior in the analyzed artifact. However, there is no evidence of a compromise in Anthropic’s official distribution on the Microsoft Marketplace. It remains unclear how this malicious version entered the publishing chain.

According to the technical analysis, the injected loader runs when VS Code loads extension.js. Developers do not need to start a Claude conversation. Unlike package-installation attacks, execution occurs at extension runtime rather than through npm lifecycle scripts.

The loader imports Node.js modules for process execution, filesystem access, operating-system inspection, HTTP communication, and cryptographic operations. It suppresses most exceptions, allowing legitimate functionality to continue even when malicious operations fail.

Its reconnaissance gathers the hostname, username, operating system, architecture, home directory, working directory, and global Git email.

It also collects names of up to 40 environment variables matching credential-related terms, including KEY, TOKEN, SECRET, PASS, AWS, and GCP. The initial beacon does not directly include their values.

The abuse reflects risks previously exposed by fake Open VSX extensions harvesting developer metadata, where familiar branding concealed unauthorized behavior.

The implant appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, using the comment svc-telemetry. It sets restrictive directory and file permissions and avoids duplicating the marker.

Next, it attempts to enable SSH through macOS Remote Login, Linux service commands, or Windows OpenSSH Server configuration. Success depends on platform configuration and available privileges.

An embedded private key supports outbound connections to tunnel@134.209.82[.]225. The forwarding argument -N -R ‘*:0:localhost:22’ requests a remotely allocated port connected to the victim’s SSH service. The loop disables host-key verification and reconnects after 60 seconds.

Claude Attack Chain (Source: opensourcemalware)

Persistence uses a deceptive macOS LaunchAgent, a Linux @reboot crontab entry, or a Windows SysMon scheduled task with a Startup-folder fallback.

After 1.5 seconds, the loader retrieves the public IP and sends reconnaissance JSON through unencrypted HTTP beacons. Unlike an earlier Open VSX extension delivering a RAT through GitHub, this injected stage downloads no additional executable payload. Its scripts and keys are already embedded.

Containment should prioritize isolating affected hosts, preserving evidence, and blocking the C2 address on ports 22 and 8099. Investigators should inspect authorized keys, persistence locations, and ssh or autossh processes containing reverse-forwarding arguments.

After collecting evidence, remove malicious components, rotate accessible credentials from a clean system, and review authentication, shell, editor, process, and network logs. Because interactive SSH access enables follow-on activity beyond the analyzed loader, deleting the extension alone cannot establish that a host is clean. Rebuilding affected systems provides stronger assurance.

IoC

TypeIndicator
Extensionanthropic.claude-code@2.1.313
C2 address134.209.82[.]225
Network portsSSH 22; HTTP 8099
Remote beaconhxxp://134.209.82[.]225:8099/beacon
Local beaconhxxp://127.0.0.1:8099/beacon
SSH markersvc-telemetry
SSH fingerprintSHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
Unix artifacts~/.config/.smt; ~/.config/.smtk; ${TMPDIR}/.stk_*
macOS persistence~/Library/LaunchAgents/com.apple.sysmond.plist
Windows artifacts.config\smt.cmd; .config\smtk; SysMon; sysmon.cmd
extension.js SHA-256ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
Embedded private-key SHA-2567e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278

Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.