detect-compromised-claude-vscode-extension-macos-2026-10-26

A security researcher published an osquery-based detection query for identifying macOS machines compromised through a backdoored version 2.1.313 of the Anthropic Claude Code VS Code extension. The query flags the installed extension across VS Code, Theia and portable-data paths, matches the malicious extension.js SHA-256 hash ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, and surfaces persistence and command-and-control indicators including an svc-telemetry SSH key, implant files, tunnel processes and connections to the C2 address 134.209.82.225.

| | SELECT 'EXPOSED' AS severity, 'extension 2.1.313 installed' AS indicator, path AS detail | | | FROM file WHERE path LIKE '/Users/%/.%/extensions/%' OR path LIKE '/Users/%/.%/%/extensions/%' | | | OR path LIKE '/Users/%/.local/share/%/extensions/%' OR path LIKE '/Applications/%-portable-data/extensions/%' | | | AND lower path LIKE '%/extensions/anthropic.claude-code-2.1.313%' | | | UNION ALL | | | SELECT 'EXPOSED', 'extension 2.1.313 installed Theia ', path | | | FROM file WHERE path LIKE '/Users/%/.%/deployedPlugins/%' | | | AND lower path LIKE '%/deployedplugins/anthropic.claude-code@2.1.313%' | | | UNION ALL | | | SELECT 'EXPOSED', 'backdoored extension.js hash', path | | | FROM hash WHERE path IN SELECT path FROM file | | | WHERE path LIKE '/Users/%/.%/extensions/%/extension.js' OR path LIKE '/Users/%/.%/%/extensions/%/extension.js' | | | OR path LIKE '/Users/%/.local/share/%/extensions/%/extension.js' | | | OR path LIKE '/Applications/%-portable-data/extensions/%/extension.js' | | | OR path LIKE '/Users/%/.%/deployedPlugins/%/extension/extension.js' | | | AND lower path LIKE '%anthropic.claude-code%' | | | AND sha256 = 'ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15' | | | UNION ALL | | | SELECT 'COMPROMISED', 'svc-telemetry key in authorized keys', key file | | | FROM users CROSS JOIN authorized keys USING uid WHERE comment LIKE '%svc-telemetry%' | | | UNION ALL | | | SELECT 'COMPROMISED', 'implant file', path | | | FROM file WHERE path LIKE '/Users/%/.config/.smt%' | | | OR path LIKE '/Users/%/Library/LaunchAgents/com.apple.sysmond.plist' | | | OR path LIKE '/Library/Launch%/com.apple.sysmond.plist' | | | OR path LIKE '/private/tmp/.stk %' | | | OR path LIKE '/private/var/folders/%/%/T/.stk %' | | | UNION ALL | | | SELECT 'COMPROMISED', 'tunnel/persistence process', pid \|\| ' ' \|\| cmdline | | | FROM processes WHERE name IN 'ssh','autossh' AND cmdline LIKE '%134.209.82.225%' OR cmdline LIKE '%.stk %' OR cmdline LIKE '%.smtk%' OR cmdline LIKE '%tunnel@%' | | | OR name IN 'sh','bash' AND cmdline LIKE '/bin/sh %.config/.smt%' | | | UNION ALL | | | SELECT 'COMPROMISED', 'connection to C2 134.209.82.225', pid \|\| ' - ' \|\| remote address \|\| ':' \|\| remote port | | | FROM process open sockets WHERE remote address = '134.209.82.225'; |