A cloned version of a developer extension linked to Claude Code has been found hosting a sophisticated backdoor that allows persistent, remote access to infected machines. Analysis confirms the malicious package, version 2.1.313, was distributed via Open VSX, targeting macOS on Apple Silicon while also including Linux and Windows attack pathways. This compromise does not appear to stem from the legitimate distribution channels or Anthropic’s official release pipeline. How the package was injected remains undetermined.
Inside the Attack Mechanism
The threat begins with a loader — about 66 lines of JavaScript — placed at the start of the extension’s main script. This loader activates hidden malicious logic without requiring the user to initiate any specific Claude function. It imports core Node.js modules to handle file manipulation, execute commands, gather system metadata, and communicate with external servers. Failures are handled silently to avoid detection while preserving the normal operation of the extension.
Core components of the payload include adding an Ed25519 public key labeled “svc-telemetry” into the user’s ~/.ssh/authorized_keys file, establishing SSH trust. Permissions of the SSH directory and authorized_keys file are appropriately hardened. The code then attempts platform-specific steps to enable remote access: activating Remote Login on macOS, launching SSH on Linux, or enabling OpenSSH via PowerShell on Windows. If these fail, the rest of the malware continues functioning.
A private key bundled within the payload is decoded into a temporary file and used to initiate a reverse SSH tunnel to an attacker‐controlled server at IP 134.209.82.225. The code attempts automatic reconnection every 60 seconds, disabling identity checks for the server. On macOS, persistence is maintained using a LaunchAgent named com.apple.sysmond.plist, along with hidden files in ~/.config. On Linux, the implant adds an @reboot entry to cron; on Windows it opts for a SYSTEM startup task or Startup folder fallback.
Information Gathering & Exfiltration
Beyond remote access, the backdoor collects system details including hostname, username, OS, architecture, paths, Git email, and values of up to 40 environment variables. Afterwards, roughly 1.5 seconds following execution, it sends system metrics via unencrypted HTTP to both the attacker’s server and the local machine. No additional binaries are downloaded during this phase, though the SSH channel could enable later attacker operations.
What to Do If You’re Exposed
Security teams are urged to check for the public key “svc-telemetry” in authorized_keys, look for persistence artifacts (like cron entries or LaunchAgents), and inspect SSH/autoSSH reverse tunneling processes. Indicators from the malware include altered hash values of extension.js. If the compromised extension has been installed, isolate the system, safeguard logs, block outbound traffic on ports 22 and 8099, rotate any credentials that might have been exposed, and carefully determine whether a full system rebuild is needed to re-establish trust.
This breach adds to a rising trend whereby developers are targeted through tools they rely on daily. By concealing malicious payloads inside otherwise legitimate developer extensions, attackers achieve stealth, persistence, and full control. The consequences could be severe: sensitive source code exposure, lateral movement across environments, and long-term undetected presence in build pipelines or servers.
Analytical perspective: This incident underscores the danger of supply-chain attacks climbing closer to the developer desktop itself. Although it’s not the first extension compromise, its use of reverse shells, SSH key planting, and cross-platform persistence reflects a maturation in adversary tradecraft. Developers and security teams must shift from reactive cleanup toward proactive validation: digitally verify tool sources, monitor extension behavior, and maintain zero-trust assumptions even within developer environments. The real risk isn’t just breached machines—it’s that attacks like this may remain dormant until weaponized for much broader compromise.
