# Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX · pwn.watch

> OpenSourceMalware reports that anthropic.claude-code version 2.1.313 on the Open VSX registry shipped a 66-line loader prepended to extension.js. On load it appends an attacker Ed25519 key (comment svc-telemetry) to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to 134.209.82.225, installs platform persistence (LaunchAgent / cron / scheduled task), and beacons host reconnaissance to that IP on port 8099. Open VSX no longer lists 2.1.313 (API 404; versions jump from 2.1.312 to 2.1.314). Clean 2.1.314 was published on Open VSX at 2026-10-30 01:07 UTC by publisher igorkofman and on the VS Marketplace shortly after. Anthropic has not issued a public statement yet; OpenSourceMalware says it confirmed the Open VSX artifact and filed threat reports for the Marketplace listing as well, but does not claim Anthropic's official distribution infrastructure was proven compromised. Anyone who installed 2.1.313 should treat the host as compromised: remove the extension, purge the IOCs, rotate credentials from a clean machine, and prefer rebuild.

Page: https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 · generated 2026-10-30T07:31:42.709Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Claude Code for VS Code (anthropic.claude-code) on Open VSX; Marketplace status unconfirmed by Anthropic
- Started: 2026-10-30
- Affected: anthropic.claude-code@2.1.313 on Open VSX (malicious; yanked — API returns not found)
- Fixed in: anthropic.claude-code@2.1.314 (Open VSX 2026-10-30T01:07:38Z; VS Marketplace ~01:16–01:20 UTC)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026.json
- This file: https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-30T04:25:18Z: Matt Johansen (@mattjay) reports the official Claude Code VS Code extension was compromised for a brief window and would have installed an SSH backdoor; links the OpenSourceMalware write-up. (https://x.com/mattjay/status/2116023617364570171)
- 2026-10-30T03:50:26Z: Independent note that 2.1.313 disappeared from Open VSX (and was never present on the npm @anthropic-ai/claude-code line, which also skipped to 2.1.314). (https://x.com/notaroko/status/2116014842016587925)
- 2026-10-30T01:16Z: VS Marketplace shows Claude Code for VS Code at 2.1.314 (lastUpdated ~01:16–01:20 UTC); no 2.1.313 returned in the gallery query. (https://marketplace.visualstudio.com/items?itemName=Anthropic.claude-code)
- 2026-10-30T01:07:38Z: Clean anthropic.claude-code 2.1.314 published on Open VSX by igorkofman; 2.1.313 is absent from the registry version list (API 404). (https://open-vsx.org/api/anthropic/claude-code)
- 2026-10-30: OpenSourceMalware analyzes anthropic.claude-code@2.1.313 from Open VSX: malicious IIFE prepended to extension.js adds svc-telemetry authorized key, reverse-tunnels to 134.209.82.225, persists via LaunchAgent/cron/SysMon, and beacons to :8099. extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. (https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor)
- 2026-10-27T20:26:56Z: Open VSX still serving anthropic.claude-code 2.1.312 (last clean version before the gap). (https://open-vsx.org/extension/anthropic/claude-code)

## Fix brief
# Security brief: Trojanized Claude Code VS Code extension (anthropic.claude-code 2.1.313) planted an SSH backdoor via Open VSX

Source: https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026 · status: live · severity: critical · updated Oct 30, 2026, 05:15 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
OpenSourceMalware reports that anthropic.claude-code version 2.1.313 on the Open VSX registry shipped a 66-line loader prepended to extension.js. On load it appends an attacker Ed25519 key (comment svc-telemetry) to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to 134.209.82.225, installs platform persistence (LaunchAgent / cron / scheduled task), and beacons host reconnaissance to that IP on port 8099. Open VSX no longer lists 2.1.313 (API 404; versions jump from 2.1.312 to 2.1.314). Clean 2.1.314 was published on Open VSX at 2026-10-30 01:07 UTC by publisher igorkofman and on the VS Marketplace shortly after. Anthropic has not issued a public statement yet; OpenSourceMalware says it confirmed the Open VSX artifact and filed threat reports for the Marketplace listing as well, but does not claim Anthropic's official distribution infrastructure was proven compromised. Anyone who installed 2.1.313 should treat the host as compromised: remove the extension, purge the IOCs, rotate credentials from a clean machine, and prefer rebuild.

Severity detail: Persistent SSH access via authorized_keys + reverse tunnel on extension load; no conversation with Claude required

- Product: Claude Code for VS Code (anthropic.claude-code) on Open VSX; Marketplace status unconfirmed by Anthropic

## Affected versions
- anthropic.claude-code@2.1.313 on Open VSX (malicious; yanked — API returns not found)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- anthropic.claude-code@2.1.314 (Open VSX 2026-10-30T01:07:38Z; VS Marketplace ~01:16–01:20 UTC)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 30, 2026: OpenSourceMalware analyzes anthropic.claude-code@2.1.313 from Open VSX: malicious IIFE prepended to extension.js adds svc-telemetry authorized key, reverse-tunnels to 134.209.82.225, persists via LaunchAgent/cron/SysMon, and beacons to :8099. extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.
- Oct 30, 2026: Clean anthropic.claude-code 2.1.314 published on Open VSX by igorkofman; 2.1.313 is absent from the registry version list (API 404).
- Oct 30, 2026: VS Marketplace shows Claude Code for VS Code at 2.1.314 (lastUpdated ~01:16–01:20 UTC); no 2.1.313 returned in the gallery query.
- Oct 30, 2026: Independent note that 2.1.313 disappeared from Open VSX (and was never present on the npm @anthropic-ai/claude-code line, which also skipped to 2.1.314).
- Oct 30, 2026: Matt Johansen (@mattjay) reports the official Claude Code VS Code extension was compromised for a brief window and would have installed an SSH backdoor; links the OpenSourceMalware write-up.
- Oct 27, 2026: Open VSX still serving anthropic.claude-code 2.1.312 (last clean version before the gap).

## Write-ups & news
- [Trojanized Claude Code Extension Plants an SSH Backdoor](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor)
- [Open VSX: Anthropic.claude-code (current 2.1.314; 2.1.313 not found)](https://open-vsx.org/extension/anthropic/claude-code)
- [VS Marketplace: Claude Code for VS Code (2.1.314)](https://marketplace.visualstudio.com/items?itemName=Anthropic.claude-code)
- [Matt Johansen on the brief Open VSX backdoor window](https://x.com/mattjay/status/2116023617364570171)

## Caveats
IOCs from OpenSourceMalware: C2 134.209.82.225 (SSH + HTTP :8099/beacon); authorized_keys comment svc-telemetry, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk; files ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist, ${TMPDIR}/.stk_*, ~/.config/smt.cmd, SysMon / sysmon.cmd. OSM caveats: analyzed Open VSX artifact; provenance of the directory is not independently established beyond that report; Microsoft Marketplace compromise not proven from their write-up alone. No Anthropic advisory found at write time. npm @anthropic-ai/claude-code never listed 2.1.313 (312→314).

---
Machine-readable: https://pwn.watch/i/claude-code-vscode-extension-ssh-backdoor-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.