Claude Code extension found with SSH backdoor on Open VSX

A malicious version of the Claude Code VS Code extension, specifically version 2.1.313, has been identified on the Open VSX registry. The trojanized version, which was published via an account associated with an Anthropic employee, contains a 66-line malicious loader prepended to the legitimate code.

The malware executes automatically upon loading the extension, without requiring user interaction or a chat session. It performs reconnaissance by collecting system information, including hostname, username, OS architecture, and Git email. It also inventories up to 40 environment variable names related to sensitive credentials, such as AWS, GCP, and secret keys.

To establish persistent access, the loader appends an SSH public key labeled “svc-telemetry” to the user’s authorized_keys file and attempts to enable remote login. It then establishes a reverse SSH tunnel to the IP address 134.209.82.225. On macOS, the malware attempts to maintain persistence by disguising itself as a LaunchAgent named “com.apple.sysmond”.

Security researchers note that while the malicious file was identified in the darwin-arm64 build for macOS, the code contains logic for Linux and Windows. Users are advised to check for specific indicators of compromise, such as the “svc-telemetry” tag and unauthorized entries in SSH configuration files, and to rotate any potentially exposed credentials.