A weaponized Claude Code extension on Open VSX allows attackers to gain persistent remote access to developer systems by deploying an SSH key, establishing a reverse tunnel, and installing startup scripts This article explores scripts researchers opensourcemalware. . Researchers from OpenSourceMalware identified the modified package as anthropic.claude-code version 2.1.313, which was disclosed on October 30.
The analyzed sample targeted macOS on Apple Silicon, but its injected code also included Linux and Windows branches.
The findings confirm a malicious artifact, not a proven compromise of Anthropic's official Visual Studio Marketplace release or its broader distribution systems. SSH Backdoor Provides Uninterrupted Access Based on OpenSourceMalware's technical analysis, the attackers inserted a 66-line JavaScript loader at the start of extension.js, preceding the legitimate extension bundle. The loader imports Node.js modules for executing commands, managing files, gathering system details, and initiating network requests.
Windows code attempts to create a SysMon startup task running as SYSTEM, with a fallback script in the Startup folder. The loader also gathers the hostname, username, operating system, architecture, directory paths, and names of up to 40 potentially sensitive environment variables. Earlier Open VSX Trivy extension attacks masked unwanted activity behind developer tools, but their payloads utilized local AI assistants instead.
Teams must scrutinize authentication, shell, editor, process, and network logs before deciding whether rebuilding the affected machine is necessary to regain trust in security.
