Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

Summary

A trojanized update, version 2.1.313, of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate extension ID anthropic.claude-code. The malicious code adds an attacker-controlled SSH key to ~/.ssh/authorized_keys, sets up a reverse tunnel and persistence, and sends host reconnaissance data to 134.209.82[.]225:8099/beacon. Anthropic has since published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.

Mitigation

Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace, and the malicious version has been removed. The source also says to follow the remediation steps in its analysis, but those steps are not included in the text provided.

Related items

• MediumTrojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer MachinesSame vendor · StepSecurity Blog
• LowCursor Removes Malicious Claude Code 2.1.313 Extension From Its MarketplaceSame vendor · Socket Blog
• MediumBeyond deterministic worms: Preparing the SOC for reasoning adversariesSame vendor · CSO Online
• InfoAPI credits benefit for eligible ChatGPT subscriptionsSame vendor · Simon Willison's Weblog
• LowAnthropic-Themed Phishing Emails Bypass Top Security ToolsSame vendor · Dark Reading