Backdoor in Claude Code Extension: Version 2.1.313 on Open VSX

On October 30, 2026, OpenSourceMalware published an analysis of a malicious build of the anthropic.claude-code extension, version 2.1.313, found on Open VSX. A 66-line loader was added to the start of extension.js. It runs when the extension activates, so you don’t need to start a Claude conversation. Most errors in the code are suppressed, so the editor keeps working normally.

What the loader does
 

• Adds an attacker’s Ed25519 key, commented svc-telemetry, to ~/.ssh/authorized_keys.
• Tries to enable an SSH service (Remote Login on macOS, sshd on Linux, OpenSSH Server on Windows). This depends on privileges and may fail.
• Connects to tunnel@134.209.82.225 and requests reverse forwarding to localhost port 22. This only works if an SSH service is reachable.
• Collects the hostname, username, OS, architecture, git email and the names (not values) of up to 40 environment variables that look like secrets. About 1.5 seconds later it sends a JSON beacon over unencrypted HTTP to port 8099 on the same server.
• Does not download any additional executable.

Persistence
 

The analyzed sample targeted macOS on Apple Silicon: files ~/.config/.smt  and ~/.config/.smtk, plus a LaunchAgent named com.apple.sysmond.plist. The code also has Linux (@reboot cron entry) and Windows (a SysMon scheduled task and a Startup-folder script) branches. These are implemented code paths, not proof of infection on every platform.

Who may be affected
 

People who installed the extension from Open VSX (Cursor, Windsurf, VSCodium and other editors that use it) and got version 2.1.313. A malicious version has not been confirmed in the Microsoft VS Code Marketplace.
 

Current status
 

As of October 30, Open VSX, the VS Code Marketplace and npm all go from 2.1.312 straight to 2.1.314, published across the three within about an hour. That doesn’t prove 2.1.313 was “removed” from Marketplace or npm. It may never have been there. No official statement from Anthropic, Open VSX or the Eclipse Foundation had been published at the time of checking.
 

What is not known
 

The researchers analyzed one artifact from Open VSX. It does not show that Anthropic’s official release or infrastructure was compromised. It is unknown how the build was published, how many machines ran it, and whether a malicious build ever existed in Marketplace. According to the OpenSourceMalware report, the Open VSX publishing account belongs to an Anthropic employee. Whether that account was compromised is not established.
 

How to check
 

• Run grep svc-telemetry ~/.ssh/authorized_keys and look for any key you didn’t add.
• macOS: look for ~/.config/.smt, ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist.
• Linux: check cron for an @reboot entry. Windows: look for a SysMon scheduled task and a script in the Startup folder.
• Look for ssh/autossh processes using reverse forwarding.
• Check network logs for connections to 134.209.82.225 on ports 22 and 8099.
• Compare the SHA-256 of any installed extension.js with the malicious one: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.

If you find traces

Isolate the host, preserve evidence, block the server on ports 22 and 8099, and rotate credentials from a clean device. Uninstalling the extension alone is not enough. The researchers recommend rebuilding the machine rather than assuming removal restores trust.
 

This is based on early reports from October 30 and details may change as the investigation continues.
 

Don't want to deal with it yourself, or need a sysadmin to help fix an error or security vulnerability?

Get help from our system administrators. We'll respond within 15 minutes!