Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX · updates https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 OpenSourceMalware reports that anthropic.claude-code version 2.1.313 on the Open VSX registry shipped a 66-line loader prepended to extension.js. On load it appends an attacker Ed25519 key (comment svc-telemetry) to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to 134.209.82.225, installs platform persistence (LaunchAgent / cron / scheduled task), and beacons host reconnaissance to that IP on port 8099. Open VSX no longer lists 2.1.313 (API 404; versions jump from 2.1.312 to 2.1.314). Clean 2.1.314 was published on Open VSX at 2026-10-30 01:07 UTC by publisher igorkofman and on the VS Marketplace shortly after. Anthropic has not issued a public statement yet; OpenSourceMalware says it confirmed the Open VSX artifact and filed threat reports for the Marketplace listing as well, but does not claim Anthropic's official distribution infrastructure was proven compromised. Anyone who installed 2.1.313 should treat the host as compromised: remove the extension, purge the IOCs, rotate credentials from a clean machine, and prefer rebuild. en Fri, 30 Oct 2026 04:25:18 GMT Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX: Matt Johansen (@mattjay) reports the official Claude Code VS Code extension was compromised for a brief window and would have installed an SSH backdoor; links the OpenSourceMalware write-up. https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026#2026-10-30-3e711a22 Fri, 30 Oct 2026 04:25:18 GMT critical <p><a href="https://x.com/mattjay/status/2116023617364570171">Source</a></p> Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX: Independent note that 2.1.313 disappeared from Open VSX (and was never present on the npm @anthropic-ai/claude-code line, which also skipped to 2.1.314). https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026#2026-10-30-08cf823e Fri, 30 Oct 2026 03:50:26 GMT critical <p><a href="https://x.com/notaroko/status/2116014842016587925">Source</a></p> Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX: VS Marketplace shows Claude Code for VS Code at 2.1.314 (lastUpdated ~01:16–01:20 UTC); no 2.1.313 returned in the gallery query. https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026#2026-10-30-a6b8c984 Fri, 30 Oct 2026 01:16:00 GMT critical <p><a href="https://marketplace.visualstudio.com/items?itemName=Anthropic.claude-code">Source</a></p> Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX: Clean anthropic.claude-code 2.1.314 published on Open VSX by igorkofman; 2.1.313 is absent from the registry version list (API 404). https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026#2026-10-30-48c53399 Fri, 30 Oct 2026 01:07:38 GMT critical <p><a href="https://open-vsx.org/api/anthropic/claude-code">Source</a></p> Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX: OpenSourceMalware analyzes anthropic.claude-code@2.1.313 from Open VSX: malicious IIFE prepended to extension.js adds svc-telemetry authorized key, reverse-tunnels to 134.209.82.225, persists via LaunchAgent/cron/SysMon, and beacons to :8099. extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026#2026-10-30-8bd90ddf Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor">Source</a></p> Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX: Open VSX still serving anthropic.claude-code 2.1.312 (last clean version before the gap). https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026#2026-10-27-f5489ff8 Tue, 27 Oct 2026 20:26:56 GMT critical <p><a href="https://open-vsx.org/extension/anthropic/claude-code">Source</a></p>