detect-compromised-claude-vscode-extension-macos-2026-10-26

| | SELECT 'EXPOSED' AS severity, 'extension 2.1.313 installed' AS indicator, path AS detail | | | FROM file WHERE (path LIKE '/Users/%/.%/extensions/%' OR path LIKE '/Users/%/.%/%/extensions/%' | | | OR path LIKE '/Users/%/.local/share/%/extensions/%' OR path LIKE '/Applications/%-portable-data/extensions/%') | | | AND lower(path) LIKE '%/extensions/anthropic.claude-code-2.1.313%' | | | UNION ALL | | | SELECT 'EXPOSED', 'extension 2.1.313 installed (Theia)', path | | | FROM file WHERE path LIKE '/Users/%/.%/deployedPlugins/%' | | | AND lower(path) LIKE '%/deployedplugins/anthropic.claude-code@2.1.313%' | | | UNION ALL | | | SELECT 'EXPOSED', 'backdoored extension.js hash', path | | | FROM hash WHERE path IN (SELECT path FROM file | | | WHERE (path LIKE '/Users/%/.%/extensions/%/extension.js' OR path LIKE '/Users/%/.%/%/extensions/%/extension.js' | | | OR path LIKE '/Users/%/.local/share/%/extensions/%/extension.js' | | | OR path LIKE '/Applications/%-portable-data/extensions/%/extension.js' | | | OR path LIKE '/Users/%/.%/deployedPlugins/%/extension/extension.js') | | | AND lower(path) LIKE '%anthropic.claude-code%') | | | AND sha256 = 'ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15' | | | UNION ALL | | | SELECT 'COMPROMISED', 'svc-telemetry key in authorized_keys', key_file | | | FROM users CROSS JOIN authorized_keys USING (uid) WHERE comment LIKE '%svc-telemetry%' | | | UNION ALL | | | SELECT 'COMPROMISED', 'implant file', path | | | FROM file WHERE path LIKE '/Users/%/.config/.smt%' | | | OR path LIKE '/Users/%/Library/LaunchAgents/com.apple.sysmond.plist' | | | OR path LIKE '/Library/Launch%/com.apple.sysmond.plist' | | | OR path LIKE '/private/tmp/.stk_%' | | | OR path LIKE '/private/var/folders/%/%/T/.stk_%' | | | UNION ALL | | | SELECT 'COMPROMISED', 'tunnel/persistence process', pid || ' ' || cmdline | | | FROM processes WHERE (name IN ('ssh','autossh') AND (cmdline LIKE '%134.209.82.225%' OR cmdline LIKE '%.stk_%' OR cmdline LIKE '%.smtk%' OR cmdline LIKE '%tunnel@%')) | | | OR (name IN ('sh','bash') AND cmdline LIKE '/bin/sh %.config/.smt%') | | | UNION ALL | | | SELECT 'COMPROMISED', 'connection to C2 134.209.82.225', pid || ' -> ' || remote_address || ':' || remote_port | | | FROM process_open_sockets WHERE remote_address = '134.209.82.225'; |