Claude Code extension (Open VSX): trojanized anthropic.claude-code 2.1.313 plants an SSH key and reverse tunnel on developer machines (no CVE)
Severity: critical · Patch status: patched · Since 2026-10-30
Version 2.1.313 of the Claude Code extension (anthropic.claude-code) on the Open VSX registry was trojanized. It was published under the official anthropic namespace, through the account that publishes the real releases. OpenSourceMalware found a 66-line loader prepended to extension.js. The loader runs when the editor starts or the extension's webview opens, with no chat needed, and hides its errors so the real extension still works. It collects host recon: hostname, user, OS, git email, and the names (not values) of secret-looking environment variables. It appends an Ed25519 key labelled "svc-telemetry" to ~/.ssh/authorizedkeys and tries to turn on the SSH server. On Windows it installs OpenSSH Server. It then opens a persistent reverse tunnel (ssh -R ':0:localhost:22') to tunnel@134.209.82.225 and beacons recon over plain HTTP to port 8099. Persistence is a LaunchAgent named com.apple.sysmond on macOS (not an Apple component), an @reboot crontab entry on Linux, and a SYSTEM scheduled task "SysMon" on Windows. The loader downloads no further payload, so anything that happened after SSH access was opened is unknown. The researchers say this shows a malicious artifact, not that Anthropic's release pipeline was compromised. How the version got published is not yet explained, and Anthropic has not commented publicly. 2.1.313 is no longer listed on Open VSX, and 2.1.314 was published on 2026-10-30. Only the Open VSX copy is confirmed malicious. The researchers also filed a precautionary report against the VS Code Marketplace copy but did not analyse it. Treat any machine that loaded 2.1.313 as remotely accessible by the attacker.
What to do
- Check installed extensions on every developer machine for anthropic.claude-code 2.1.313 (e.g. `code --list-extensions --show-versions`, and the same for Cursor, Windsurf, VSCodium). Update to 2.1.314 or later, but only after you collect evidence.
- Look in every user's ~/.ssh/authorized_keys for a key with the comment "svc-telemetry" (fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk).
- Look for long-running ssh or autossh processes with `-R *:0:localhost:22`, or with tunnel@134.209.82.225 as the target.
- Block 134.209.82.225 on ports 22 and 8099 at the egress, and search proxy, firewall and EDR logs for past connections to it.
- Hunt for persistence: ~/.config/.smt, ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist (macOS); an @reboot crontab entry (Linux); the SysMon scheduled task, sysmon.cmd in the Startup folder, and .config\smt.cmd (Windows); and ${TMPDIR}/.stk_* key files.
- If the extension was loaded: isolate the host and preserve evidence first. Then, from a clean machine, rotate every credential the account could reach (SSH keys, cloud keys, git and npm tokens, Claude/API keys). Rebuild the host instead of trusting cleanup.
- Pin editor extensions and turn off auto-update for AI coding extensions on sensitive machines. For fork editors, prefer the publisher's verified source over Open VSX until the root cause is published.
Fixed versions
- anthropic.claude-code 2.1.314 (published 2026-10-30)
Sources
All live incidents on Threat Watch
