Trojanized Claude Code Extension Plants an SSH Backdoor A trojanized package posing as Anthropic's Claude Code extension for macOS on Apple Silicon, labeled `anthropic.claude-code` version `2.1.313`, carries a 66-line malicious loader prepended to its main JavaScript bundle that adds an attacker-controlled Ed25519 key labeled `svc-telemetry` to `~/.ssh/authorized_keys`, opens a reverse SSH tunnel to `134.209.82.225`, and beacons host reconnaissance over unencrypted HTTP on port 8099, according to an analysis published by an unnamed security blog. The loader runs before the legitimate extension code, so merely loading the module triggers it without the user starting a Claude conversation, and the package declares no install, build, prepare, preinstall, or postinstall scripts. The analyzed artifact came from Open VSX, though version 2.1.313 is also removed from the official npm and VS Code pages, and the researchers state the findings do not by themselves show Anthropic's official Marketplace release or distribution infrastructure was compromised. BLOG Trojanized Claude Code Extension Plants an SSH Backdoor v 2.1.313 contains a loader that runs ahead of the real extension code adds an attacker key, opens a reverse tunnel, and sets persistence By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 · Today we analyzed a trojanized extension purporting to be Anthropic’s Claude Code extension for macOS on Apple Silicon. Big shout out to Dean Hardcastle for the heads up on this one The package identifies itself as anthropic.claude-code version 2.1.313 , but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code. The extension we analyzed was from Open VSX. However, you can see in the official npm and VS Code pages that v 2.1.313 is also removed, implying it was delivered through those ecosystems also. The unpacked extension initially looks plausible. Its manifest declares the publisher as Anthropic, uses expected Claude branding, and contains a large bundled application, webview resources, documentation, fonts, and a native macOS audio-capture module. The extension activates after VS Code startup and when its webview opens. It adds an attacker-controlled key to the user’s SSH configuration, attempts to enable the local SSH service, establishes a reverse tunnel to 134.209.82.225 , installs platform-specific persistence, and transmits host reconnaissance over an unencrypted HTTP beacon. Static inspection of the main entry point immediately revealed a different story. The first line starts a standalone, immediately invoked function that imports Node.js process, filesystem, operating-system, HTTP, and cryptographic modules. That function ends at line 66. Only after it finishes does the expected bundled extension begin. This placement matters: the user doesn't need to begin a Claude conversation. Loading the extension module is enough. The package declares no install, build, prepare, preinstall, or postinstall scripts, so the malicious behavior occurs at extension runtime rather than through a package-manager lifecycle hook. The provenance of the analyzed directory is not established. These findings show that this specific artifact is malicious; they do not, by themselves, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised. TL;DR - Threat Type: Trojanized developer-tool extension and persistent SSH backdoor - Affected Ecosystem: Visual Studio Code extensions - Claimed Package: anthropic.claude-code@2.1.313 for darwin-arm64 - Impact: Persistent remote access through an authorized SSH key and reverse SSH tunnel - C2: 134.209.82.225 over SSH and HTTP port 8099 - Key Finding: Malicious code is prepended to the normal extension bundle and executes before legitimate initialization - Additional Payloads: None downloaded by the injected stage; its curl requests retrieve only public-IP text Technical Analysis Immediate reconnaissance At load time, the implant collects: - Hostname and local username - Operating system and CPU architecture - Home directory and current working directory - Global Git email from git config --global user.email - Names of up to 40 environment variables containing KEY , TOKEN , SECRET , PASS , AWS , or GCP Environment-variable values are not placed directly in the initial beacon. Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly. Nearly every exception is suppressed. This lets the legitimate extension continue loading when malicious operations fail, reducing visible signs of compromise. Authorized-key installation If a home directory is available, the implant creates ~/.ssh , changes it to mode 0700 , and appends an Ed25519 key to ~/.ssh/authorized keys . The key is labeled svc-telemetry , an innocuous-looking comment intended to resemble an administrative account. ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry Its fingerprint is: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk The implant sets authorized keys to mode 0600 . If the marker already exists, it records that fact instead of adding a duplicate. SSH service enablement The next branch attempts to make the victim reachable through SSH: - macOS: checks Remote Login and, if disabled, runs sudo -n systemsetup -setremotelogin on - Linux: checks sshd or ssh with systemctl , then tries several service-start commands - Windows: uses PowerShell to install OpenSSH Server, configure automatic startup, and start sshd These operations may fail without sufficient privileges, but failure does not stop the remaining attack chain. Reverse SSH tunnel The implant embeds a base64-encoded OpenSSH private key and decodes it into a temporary file named .stk