# Tampered Claude Code Extension Planted SSH Access on Developer Machines

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/44373
Published: 2026-10-30T07:23:31.000Z
Updated: 2026-10-30T07:23:31.000Z
Section: Technology

> The code could run when VS Code launched or a webview opened, without a user starting a Claude conversation.

Security researcher Paul McCarty (6mile) identified a tampered Anthropic Claude Code extension on Open VSX that added SSH access and persistence to developer machines, with findings limited to analyzed version 2.1.313.

The package, listed as anthropic.claude-code@2.1.313, included a 66-line loader placed before the extension’s regular code. McCarty’s analysis found it could run when VS Code launched or a webview opened, without a user starting a Claude conversation.

The code wrote an attacker key labeled “svc-telemetry” into the user’s SSH configuration, attempted to enable a local SSH service and opened a reverse tunnel to 134.209.82.225. It also set persistence mechanisms on macOS, Linux and Windows, then sent host reconnaissance data over unencrypted HTTP to port 8099. The injection did not download another executable or script.

McCarty identified the analyzed Open VSX package as the confirmed malicious sample. He submitted a precautionary threat report about the same version in Microsoft’s VS Code Marketplace; that report did not confirm that copy was compromised. His analysis found the unpacked extension and bundled binaries matched the normal release, with the change confined to extension.js.