Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Supply chain
LivePatchedSupply chain

Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX

Claude Code for VS Code (anthropic.claude-code) on Open VSX; Marketplace status unconfirmed by Anthropic

OpenSourceMalware reports that anthropic.claude-code version 2.1.313 on the Open VSX registry shipped a 66-line loader prepended to extension.js. On load it appends an attacker Ed25519 key (comment svc-telemetry) to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to 134.209.82.225, installs platform persistence (LaunchAgent / cron / scheduled task), and beacons host reconnaissance to that IP on port 8099. Open VSX no longer lists 2.1.313 (API 404; versions jump from 2.1.312 to 2.1.314). Clean 2.1.314 was published on Open VSX at 2026-10-30 01:07 UTC by publisher igorkofman and on the VS Marketplace shortly after. Anthropic has not issued a public statement yet; OpenSourceMalware says it confirmed the Open VSX artifact and filed threat reports for the Marketplace listing as well, but does not claim Anthropic's official distribution infrastructure was proven compromised. Anyone who installed 2.1.313 should treat the host as compromised: remove the extension, purge the IOCs, rotate credentials from a clean machine, and prefer rebuild.

Why this severity: Persistent SSH access via authorized_keys + reverse tunnel on extension load; no conversation with Claude required

Started
Oct 30, 2026

Follow this incident

Discuss on X ↗

Affected

  • anthropic.claude-code@2.1.313 on Open VSX (malicious; yanked — API returns not found)

Fixed in

  • anthropic.claude-code@2.1.314 (Open VSX 2026-10-30T01:07:38Z; VS Marketplace ~01:16–01:20 UTC)

Timeline6

  1. OpenSourceMalware analyzes anthropic.claude-code@2.1.313 from Open VSX: malicious IIFE prepended to extension.js adds svc-telemetry authorized key, reverse-tunnels to 134.209.82.225, persists via LaunchAgent/cron/SysMon, and beacons to :8099. extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.

  2. Clean anthropic.claude-code 2.1.314 published on Open VSX by igorkofman; 2.1.313 is absent from the registry version list (API 404).

  3. VS Marketplace shows Claude Code for VS Code at 2.1.314 (lastUpdated ~01:16–01:20 UTC); no 2.1.313 returned in the gallery query.

  4. Independent note that 2.1.313 disappeared from Open VSX (and was never present on the npm @anthropic-ai/claude-code line, which also skipped to 2.1.314).

  5. Matt Johansen (@mattjay) reports the official Claude Code VS Code extension was compromised for a brief window and would have installed an SSH backdoor; links the OpenSourceMalware write-up.

  6. Open VSX still serving anthropic.claude-code 2.1.312 (last clean version before the gap).

News & write-ups4
Posts1

Notes & caveats

IOCs from OpenSourceMalware: C2 134.209.82.225 (SSH + HTTP :8099/beacon); authorized_keys comment svc-telemetry, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk; files ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist, ${TMPDIR}/.stk_*, ~/.config/smt.cmd, SysMon / sysmon.cmd. OSM caveats: analyzed Open VSX artifact; provenance of the directory is not independently established beyond that report; Microsoft Marketplace compromise not proven from their write-up alone. No Anthropic advisory found at write time. npm @anthropic-ai/claude-code never listed 2.1.313 (312→314).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot