Malicious Claude Code extension installs SSH backdoor

The compromised extension

A malicious version of the official Claude Code VSCode extension was identified on the Open-VSX registry. The affected version is 2.1.313, which identifies itself as anthropic.claude-code. While the official binary remains unchanged, the main JavaScript bundle was modified to include a malicious loader.

The loader is a 66-line block of code inserted at the very beginning of the extension.js file. Because it is placed before the legitimate code, the malicious actions trigger as soon as the extension is loaded by VS Code. Users do not need to actually start a conversation with Claude for the code to run.

The owner of the affected Open-VSX extension is an Anthropic employee named Igor Kofman. However, it is currently unknown if the employee was personally compromised or if the distribution process was hijacked. The analysis confirms this specific artifact is malicious but does not prove the entire Anthropic infrastructure was breached.

How the backdoor works

Once the extension activates, the loader performs immediate reconnaissance on the host system. It collects the local username, hostname, operating system, and CPU architecture. It also searches for environment variables that might contain sensitive information, specifically looking for terms like KEY, TOKEN, SECRET, PASS, AWS, and GCP.

To ensure long-term access, the malware modifies the user's SSH configuration. It creates a directory for SSH keys if one does not exist and appends a new Ed25519 key to the authorized_keys file. This key is labeled as 'svc-telemetry' to make it look like a standard administrative account rather than a backdoor.

The malware also attempts to make the machine reachable from the internet. On macOS, it tries to enable Remote Login. On Linux, it attempts to start the sshd or ssh services using systemctl. On Windows, it uses PowerShell to install the OpenSSH Server and configure it to start automatically on boot.

Establishing a tunnel

The extension includes a base64-encoded private key used to establish a reverse SSH tunnel. It decodes this key into a temporary file and connects to a remote server at 134.209.82.225. This tunnel allows the attacker to forward connections from the remote server back to the victim's local machine on port 22.

To maintain this connection, the malware uses a loop that reconnects every 60 seconds if the link drops. It is designed to ignore the user's known_hosts file and disable host-key verification. This ensures the tunnel stays active without prompting the user for confirmation or showing errors.

Additionally, the malware sends a reconnaissance beacon to a specific URL. It uses curl to fetch the victim's public IP address from services like ifconfig.me and ipify.org. This data is then sent as a JSON object to a command and control (C2) server located at 134.209.82.225 on port 8099.

Persistence and detection

The malware implements different methods to stay on the system depending on the operating system. On macOS, it creates a LaunchAgent with a deceptive name, 'com.apple.sysmond.plist', to keep the tunnel running. On Linux, it adds a script to the user's crontab with an @reboot entry to ensure it starts every time the system boots.

Windows users may see a scheduled task named 'SysMon' or a script in the Startup folder if the malware is successful. The malware is designed to suppress almost all exceptions. This means if a specific action fails, the legitimate extension will still load normally, making the infection harder for a user to notice.

Security researchers suggest that because this creates an interactive path to the system, the files seen might not represent the full extent of the breach. They recommend blocking the IP address 134.209.82.225 and rotating all credentials that were accessible from the affected machine. Rebuilding the host is often the safest way to ensure the system is clean.