Claude Code VS Code extension implanted with SSH backdoor

On October 30, security researcher Paul McCarty (6mile) posted on the OpenSource Malware blog that Anthropic's Claude Code VS Code extension was tampered with that day, and a malicious version 2.1.313 was published to the Open VSX registry. The extension is identified as anthropic.claude-code@2.1.313, and a 66-line loader was inserted before the normal extension code in the main JavaScript package. The researchers stated that currently, only the analyzed Open VSX version has been confirmed as a malicious sample, and a threat report has been submitted for the same version in the Microsoft VS Code marketplace out of caution.

The article states that the unpacked extension and bundled binaries are consistent with the normal version, with differences only in extension.js. The extension loads this file after VS Code starts and when the Webview opens, triggering without the user needing to initiate a Claude conversation. The loader writes an attacker key labeled svc-telemetry to the user's SSH configuration, attempts to enable local SSH services, establishes a reverse tunnel to 134.209.82.225, and sets persistence on macOS, Linux, and Windows, then sends host reconnaissance information to port 8099 at that address via unencrypted HTTP. No additional executable files or scripts are downloaded during the injection phase.

The researchers stated that the owner of the affected Open VSX extension is Anthropic employee Igor Kofman, and it is currently unclear whether his account or another release link was exploited; Dean Hardcastle informed him at the time of the incident. The article clarifies that the source of the analyzed directory has not been established, and the related findings cannot independently prove that Anthropic's official marketplace or distribution infrastructure has been compromised; the identity of the attacker and the ownership of the infrastructure have also not been verified. The text suggests searching for related file paths, key annotations, and startup items, blocking ports 22 and 8099 of 134.209.82.225, and rotating credentials accessible by affected accounts on a clean system.