Trojanized Claude Code Extension Plants an SSH Backdoor

What it is

A trojanized build of the anthropic.claude-code extension, version 2.1.313, target platform darwin-arm64, found on Open VSX. A 66-line immediately invoked function is prepended to extension.js and runs before the real bundle. Loading the extension is enough to trigger it; no Claude conversation is needed. The package has no install or postinstall scripts, so nothing fires at install time. The page says 2.1.313 is also removed from the official npm and VS Code pages, which implies it was delivered there too. It does not say how the artifact was obtained, and it does not show that Anthropic's release infrastructure was compromised.

How it works

• Recon: collects hostname, username, OS and architecture, home and working directories, the global Git email, and the names (not values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.
• Access: appends an Ed25519 key commented svc-telemetry to ~/.ssh/authorized_keys, setting .ssh to 0700 and the file to 0600.
• SSH enablement: on macOS runs sudo -n systemsetup -setremotelogin on if Remote Login is off. Linux and Windows have their own branches. Failure does not stop the chain.
• Tunnel: decodes an embedded private key to .stk_<identifier> in the temp directory and loops tunnel@134.209.82.225 with -N -R '*:0:localhost:22'. It disables host-key checking, reconnects every 60 seconds, and prefers autossh on Unix.
• Persistence: on macOS, ~/.config/.smt, ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist (RunAtLoad, KeepAlive). On Linux, the same files plus an @reboot crontab entry. On Windows, smt.cmd and smtk under .config, a SYSTEM scheduled task named SysMon, or a Startup-folder sysmon.cmd as fallback.
• Beacon: after 1.5 seconds, looks up the public IP with curl against ifconfig.me and api.ipify.org, then POSTs the JSON to http://127.0.0.1:8099/beacon and http://134.209.82.225:8099/beacon. The response is discarded.
• Errors: nearly all exceptions are suppressed, so the real extension loads normally.

Preconditions / Affected

Anyone who loaded anthropic.claude-code 2.1.313 (darwin-arm64) from Open VSX, and possibly npm or VS Code. The home directory must exist for key installation. Enabling Remote Login needs passwordless sudo. Whether the forwarded port is reachable beyond the C2 host depends on that server's SSH configuration, but the operator can use the tunnel directly.

What to do

Indicators to search for:

134.209.82.225   (ports 22 and 8099)
tunnel@134.209.82.225
svc-telemetry
SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk   (key fingerprint)
~/.config/.smt   ~/.config/.smtk
~/Library/LaunchAgents/com.apple.sysmond.plist
${TMPDIR}/.stk_*
~/.config/smt.cmd   ~/.config/smtk
scheduled task SysMon, sysmon.cmd

Hashes (SHA-256):

extension.js  ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
tunnel key    7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278
directory     18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927

Process telemetry may show long-running ssh or autossh with -R *:0:localhost:22. Check loaded LaunchAgents and every user's authorized_keys on macOS.

If the extension was loaded:

1. Disconnect the host and preserve forensic evidence.
2. Block 134.209.82.225 on ports 22 and 8099.
3. Remove the extension and persistence only after collecting evidence.
4. Rotate credentials reachable from the account, from a known-clean system.
5. Review SSH, shell, process, VS Code, authentication and network logs for follow-on activity.

The page recommends rebuilding the host rather than trusting removal of known artifacts.

Caveats

The analysis is static and covers one artifact. The injected stage downloads no further payloads, but anything the operator did through the tunnel would not appear in it. The page found no blockchain-based payload resolution. Distribution source, attacker identity, infrastructure ownership and official release status are unverified.