Malicious Claude Code Extension Delivers Persistent Remote Access to Developers
A compromised version of the 'anthropic.claude-code' extension on Open VSX installs an SSH backdoor, enabling attackers to gain persistent remote access to developer systems.
Researchers have uncovered a malicious version of the 'anthropic.claude-code' extension, specifically version 2.1.313, distributed via the Open VSX registry. This tampered extension, identified by OpenSourceMalware, poses a significant risk to developers by establishing a persistent SSH backdoor on their systems. The malicious code is embedded within the extension's JavaScript loader, which executes automatically when the extension is active, even without an active Claude conversation. This allows attackers to maintain a foothold on compromised machines.
The core of the attack involves the implantation of an Ed25519 public key, identified by the comment 'svc-telemetry,' into the ~/.ssh/authorized_keys file. This grants the attacker SSH access to the victim's system. The extension then attempts to establish a reverse tunnel to attacker-controlled infrastructure located at 134.209.82.225 on port 22. This tunnel, facilitated by tools like autossh or standard SSH, effectively routes traffic from the attacker's server directly to the victim's SSH service, bypassing typical network defenses.
To ensure persistence, the malware installs startup scripts tailored for different operating systems. On macOS, it utilizes a user-level LaunchAgent (com.apple.sysmond.plist) for continuous operation. For Linux systems, it adds an @reboot cron entry. The Windows variant attempts to create a SYSTEM-level startup task or a fallback script in the Startup folder. While these persistence mechanisms are implemented, their successful execution depends on the permissions available on the victim's system.
Beyond establishing remote access, the malicious extension also functions as an information-gathering tool. It collects system details such as the hostname, username, operating system, architecture, directory paths, Git email, and a list of up to 40 environment variables. This data is then exfiltrated via unencrypted HTTP requests to the attacker's server on port 8099, alongside the victim's public IP address. The collected information could be used for further targeted attacks or reconnaissance.
It is crucial to note that the discovered malicious artifact was found on Open VSX and does not indicate a compromise of Anthropic's official Visual Studio Marketplace release or their broader distribution channels. The exact method by which the extension package was altered remains unknown. However, the technique of injecting malicious code that runs during normal extension activity, rather than during installation, is a recurring theme observed in previous supply-chain attacks.
Security researchers advise defenders to meticulously inspect their authorized_keys files for the 'svc-telemetry' key, search for the specific persistence files mentioned, and monitor for unusual ssh or autossh processes utilizing reverse forwarding. Indicators of compromise, including file hashes for the altered JavaScript, have been published by OpenSourceMalware.
If an infection is suspected, immediate steps should include isolating the affected host, preserving forensic evidence, and blocking the attacker's IP address (134.209.82.225) on ports 22 and 8099. After evidence collection, persistence mechanisms should be removed, and any exposed credentials rotated from a clean device. Uninstalling the extension alone is insufficient; a thorough review of authentication, shell, editor, process, and network logs is recommended to determine if a full system rebuild is necessary to ensure security.