{"slug": "detect-compromised-claude-vscode-extension-macos-2026-10-26", "title": "detect-compromised-claude-vscode-extension-macos-2026-10-26", "summary": "A security researcher published an osquery-based detection query for identifying macOS machines compromised through a backdoored version 2.1.313 of the Anthropic Claude Code VS Code extension. The query flags the installed extension across VS Code, Theia and portable-data paths, matches the malicious extension.js SHA-256 hash ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, and surfaces persistence and command-and-control indicators including an svc-telemetry SSH key, implant files, tunnel processes and connections to the C2 address 134.209.82.225.", "body_md": "|  | SELECT 'EXPOSED' AS severity, 'extension 2.1.313 installed' AS indicator, path AS detail | \n|  | FROM file WHERE (path LIKE '/Users/%/.%/extensions/%' OR path LIKE '/Users/%/.%/%/extensions/%' | \n|  | OR path LIKE '/Users/%/.local/share/%/extensions/%' OR path LIKE '/Applications/%-portable-data/extensions/%') | \n|  | AND lower(path) LIKE '%/extensions/anthropic.claude-code-2.1.313%' | \n|  | UNION ALL | \n|  | SELECT 'EXPOSED', 'extension 2.1.313 installed (Theia)', path | \n|  | FROM file WHERE path LIKE '/Users/%/.%/deployedPlugins/%' | \n|  | AND lower(path) LIKE '%/deployedplugins/anthropic.claude-code@2.1.313%' | \n|  | UNION ALL | \n|  | SELECT 'EXPOSED', 'backdoored extension.js hash', path | \n|  | FROM hash WHERE path IN (SELECT path FROM file | \n|  | WHERE (path LIKE '/Users/%/.%/extensions/%/extension.js' OR path LIKE '/Users/%/.%/%/extensions/%/extension.js' | \n|  | OR path LIKE '/Users/%/.local/share/%/extensions/%/extension.js' | \n|  | OR path LIKE '/Applications/%-portable-data/extensions/%/extension.js' | \n|  | OR path LIKE '/Users/%/.%/deployedPlugins/%/extension/extension.js') | \n|  | AND lower(path) LIKE '%anthropic.claude-code%') | \n|  | AND sha256 = 'ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15' | \n|  | UNION ALL | \n|  | SELECT 'COMPROMISED', 'svc-telemetry key in authorized_keys', key_file | \n|  | FROM users CROSS JOIN authorized_keys USING (uid) WHERE comment LIKE '%svc-telemetry%' | \n|  | UNION ALL | \n|  | SELECT 'COMPROMISED', 'implant file', path | \n|  | FROM file WHERE path LIKE '/Users/%/.config/.smt%' | \n|  | OR path LIKE '/Users/%/Library/LaunchAgents/com.apple.sysmond.plist' | \n|  | OR path LIKE '/Library/Launch%/com.apple.sysmond.plist' | \n|  | OR path LIKE '/private/tmp/.stk_%' | \n|  | OR path LIKE '/private/var/folders/%/%/T/.stk_%' | \n|  | UNION ALL | \n|  | SELECT 'COMPROMISED', 'tunnel/persistence process', pid \\|\\| ' ' \\|\\| cmdline | \n|  | FROM processes WHERE (name IN ('ssh','autossh') AND (cmdline LIKE '%134.209.82.225%' OR cmdline LIKE '%.stk_%' OR cmdline LIKE '%.smtk%' OR cmdline LIKE '%tunnel@%')) | \n|  | OR (name IN ('sh','bash') AND cmdline LIKE '/bin/sh %.config/.smt%') | \n|  | UNION ALL | \n|  | SELECT 'COMPROMISED', 'connection to C2 134.209.82.225', pid \\|\\| ' -> ' \\|\\| remote_address \\|\\| ':' \\|\\| remote_port | \n|  | FROM process_open_sockets WHERE remote_address = '134.209.82.225'; |", "url": "https://wpnews.pro/news/detect-compromised-claude-vscode-extension-macos-2026-10-26", "canonical_source": "https://gist.github.com/RichardoC/9753dfa5aeffc6a1201f5e57114f54ff", "published_at": "2026-10-30 12:01:41+00:00", "updated_at": "2026-10-30 12:47:15.962903+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["Anthropic", "Claude Code", "Visual Studio Code", "Theia", "osquery"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/detect-compromised-claude-vscode-extension-macos-2026-10-26", "markdown": "https://wpnews.pro/news/detect-compromised-claude-vscode-extension-macos-2026-10-26.md", "text": "https://wpnews.pro/news/detect-compromised-claude-vscode-extension-macos-2026-10-26.txt", "jsonld": "https://wpnews.pro/news/detect-compromised-claude-vscode-extension-macos-2026-10-26.jsonld"}}