Claude Code VS Code Extension 2.1.313 Found With SSH Backdoor on Open VSX

A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution. The extension, identified as [email protected], differed from the legitimate version only in extension.js, where a 66-line loader had been inserted before the normal code. The file runs when VS Code starts and when a Webview opens, so users do not need to start a Claude conversation to trigger it. The loader adds an attacker-controlled SSH key labeled svc-telemetry to users’ SSH configuration, attempts to enable local SSH service, creates a reverse tunnel to 134.209.82.225, establishes persistence on macOS, Linux and Windows, and sends host reconnaissance data over unencrypted HTTP to port 8099. No additional executable files or scripts were downloaded during the injection phase. The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised. Dean Hardcastle notified Kofman during the incident. Researchers said the source of the analyzed directory has not been established; the findings alone do not prove that Anthropic’s official marketplace or distribution infrastructure was compromised, and the attacker’s identity and infrastructure ownership remain unverified. Recommendations include checking for related file paths, key comments and startup items, blocking ports 22 and 8099 at 134.209.82.225, and rotating credentials accessible to affected accounts from a clean system.