Tampered Claude Code Extension Planted SSH Access on Developer Machines

Security researcher Paul McCarty (6mile) identified a tampered Anthropic Claude Code extension on Open VSX that added SSH access and persistence to developer machines, with findings limited to analyzed version 2.1.313.

The package, listed as anthropic.claude-code@2.1.313, included a 66-line loader placed before the extension’s regular code. McCarty’s analysis found it could run when VS Code launched or a webview opened, without a user starting a Claude conversation.

The code wrote an attacker key labeled “svc-telemetry” into the user’s SSH configuration, attempted to enable a local SSH service and opened a reverse tunnel to 134.209.82.225. It also set persistence mechanisms on macOS, Linux and Windows, then sent host reconnaissance data over unencrypted HTTP to port 8099. The injection did not download another executable or script.

McCarty identified the analyzed Open VSX package as the confirmed malicious sample. He submitted a precautionary threat report about the same version in Microsoft’s VS Code Marketplace; that report did not confirm that copy was compromised. His analysis found the unpacked extension and bundled binaries matched the normal release, with the change confined to extension.js.