--- title: 'Backdoor in Claude Code 2.1.313: How to Check Your System' description: 'A malicious version of Claude Code 2.1.313 was discovered on Open VSX. Learn how to detect the backdoor, check SSH keys, and secure your system.' image: 'https://cdn.zomro.com/uploads/blog/denis.fesenko%40zomro.org/2026/10/30/1_q50.jpg' --- ![opened image]() * [Zomro](https://zomro.com/) * [Useful articles](https://zomro.com/blog/articles/) * Backdoor in Claude Code Extension: Version 2.1.313 on Open VSX # Backdoor in Claude Code Extension: Version 2.1.313 on Open VSX 30-10-2026 ![Backdoor in Claude Code Extension: Version 2.1.313 on Open VSX](https://cdn.zomro.com/uploads/blog/denis.fesenko%40zomro.org/2026/10/30/1_q50.jpg) On October 30, 2026, OpenSourceMalware published an analysis of a malicious build of the _anthropic.claude-code_ extension, version 2.1.313, found on Open VSX. A 66-line loader was added to the start of __extension.js__. It runs when the extension activates, so you don’t need to start a Claude conversation. Most errors in the code are suppressed, so the editor keeps working normally. ## What the loader does * Adds an attacker’s Ed25519 key, commented __svc-telemetry__ , to __~/.ssh/authorized_keys.__ * Tries to enable an SSH service (Remote Login on macOS, sshd on Linux, OpenSSH Server on Windows). This depends on privileges and may fail. * Connects to __tunnel@134.209.82.225__ and requests reverse forwarding to localhost port 22. This only works if an SSH service is reachable. * Collects the hostname, username, OS, architecture, git email and the names (not values) of up to 40 environment variables that look like secrets. About 1.5 seconds later it sends a JSON beacon over unencrypted HTTP to port 8099 on the same server. * Does not download any additional executable. ## Persistence The analyzed sample targeted macOS on Apple Silicon: files __~/.config/.smt__ and __~/.config/.smtk__ , plus a LaunchAgent named __com.apple.sysmond.plist__. The code also has Linux (__@reboot__ cron entry) and Windows (a __SysMon__ scheduled task and a Startup-folder script) branches. These are implemented code paths, not proof of infection on every platform. ## Who may be affected People who installed the extension from Open VSX (Cursor, Windsurf, VSCodium and other editors that use it) and got version 2.1.313. A malicious version has not been confirmed in the Microsoft VS Code Marketplace. ## Current status As of October 30, Open VSX, the VS Code Marketplace and npm all go from 2.1.312 straight to 2.1.314, published across the three within about an hour. That doesn’t prove 2.1.313 was “removed” from Marketplace or npm. It may never have been there. No official statement from Anthropic, Open VSX or the Eclipse Foundation had been published at the time of checking. ## What is not known The researchers analyzed one artifact from Open VSX. It does not show that Anthropic’s official release or infrastructure was compromised. It is unknown how the build was published, how many machines ran it, and whether a malicious build ever existed in Marketplace. According to the OpenSourceMalware report, the Open VSX publishing account belongs to an Anthropic employee. Whether that account was compromised is not established. How to check * Run __grep svc-telemetry ~/.ssh/authorized_keys__ and look for any key you didn’t add. * macOS: look for __~/.config/.smt, ~/.config/.smtk__ and __~/Library/LaunchAgents/com.apple.sysmond.plist.__ * Linux: check cron for an __@reboot__ entry. Windows: look for a __SysMon__ scheduled task and a script in the Startup folder. * Look for __ssh/autossh__ processes using reverse forwarding. * Check network logs for connections to __134.209.82.225__ on ports 22 and 8099. * Compare the SHA-256 of any installed __extension.js__ with the malicious one: __ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15__. ## If you find traces Isolate the host, preserve evidence, block the server on ports 22 and 8099, and rotate credentials from a clean device. Uninstalling the extension alone is not enough. The researchers recommend rebuilding the machine rather than assuming removal restores trust. __This is based on early reports from October 30 and details may change as the investigation continues.__ **Don't want to deal with it yourself, or need a sysadmin to help fix an error or security vulnerability?** **Get help from**[**our system administrators**](https://zomro.com/paid-support-services/server-management-services)**. We'll respond within 15 minutes!** Similar articles: [Using Telnet in Ubuntu 24.04 LTS](https://zomro.com/blog/articles/512-using-telnet-in-ubuntu-lts) [Using Docker and Kubernetes for Marketplace Deployment](https://zomro.com/blog/articles/629-using-docker-and-kubernetes-to-deploy-marketplaces) [API - Interaction with Rescue](https://zomro.com/blog/articles/485-api-interacting-with-rescue) [Best CDN Providers: Comparing Top Content Delivery Network Companies in 2025](https://zomro.com/blog/articles/639-best-cdn-providers-comparing-top-content-delivery-network-companies-in-2025) [Backdoor in Claude Code Extension: Version 2.1.313 on Open VSX](https://zomro.com/blog/articles/754-backdoor-in-claude-code-extension-version-21313-on-open-vsx) [ Dedicated servers from €74.24/mon ](/dedicated-servers)