Weaponized Claude Code Extension Gives Hackers Persistent Remote Access to Developer Systems

A weaponized Claude Code extension found on Open VSX can give attackers persistent remote access to developer systems by planting an SSH key, opening a reverse tunnel, and installing startup scripts.

OpenSourceMalware identified the tampered package as anthropic.claude-code version 2.1.313 in research published on October 30.

The analyzed sample targeted macOS on Apple Silicon. However, its injected code also contained Linux and Windows branches. Crucially, the findings confirm a malicious artifact, not a proven compromise of Anthropic’s official Visual Studio Marketplace release or its wider distribution systems. How the package was altered remains unknown.

SSH Backdoor Creates Persistent Access

According to OpenSourceMalware’s technical analysis, attackers placed a 66-line JavaScript loader at the beginning of extension.js, ahead of the legitimate extension bundle. Loading that module triggers the malicious code. Developers do not need to start a Claude conversation.

The loader imports Node.js modules for running commands, handling files, collecting system details, and making network requests. Most errors are suppressed, allowing the normal extension to keep working even when malicious steps fail. The harmful code runs during extension activity rather than through package installation scripts.

This approach echoes the earlier Nx Console extension compromise, where injected code ran when developers opened a workspace. That comparison highlights a shared risk, not evidence that the incidents have the same attackers.

The implant adds an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys with the comment svc-telemetry. It sets the SSH directory permissions to 0700 and the authorized_keys file to 0600, making the setup resemble a normal SSH configuration.

It then tries to enable Remote Login on macOS, start an SSH service on Linux, or install and start OpenSSH Server through PowerShell on Windows. These steps depend on available permissions and may fail without stopping the remaining code.

An embedded private key is decoded into a temporary .stk_ file. The malware connects to [email protected] and requests reverse forwarding to localhost port 22. This creates a route from the attacker’s server to the victim’s SSH service, provided that service is available.

The tunnel disables server identity checks and reconnects after 60 seconds. On Unix-like systems, it prefers autossh and otherwise uses ssh.

On macOS, persistence uses ~/.config/.smt, ~/.config/.smtk, and a LaunchAgent named com.apple.sysmond.plist. Despite its name, this user-level LaunchAgent is not an Apple component. It uses RunAtLoad and KeepAlive to launch and maintain the tunnel.

The Linux branch adds an @reboot cron entry. Windows code attempts to create a SysMon startup task running as SYSTEM, with a Startup-folder script as a fallback. These are implemented code paths, not proof of successful infection across every platform.

The loader also collects the hostname, username, operating system, architecture, directory paths, Git email, and names of up to 40 potentially sensitive environment variables. Their values are not directly included in the initial beacon.

After 1.5 seconds, it checks the public IP and sends JSON over unencrypted HTTP to port 8099 at 134.209.82.225 and localhost. No additional executable is downloaded by this loader. Its SSH access could still support later attacker activity.

Earlier Open VSX Trivy extension attacks also hid unwanted activity behind working developer tools, though their payloads used local AI assistants instead.

Defenders should inspect authorized_keys for svc-telemetry, search for the persistence files, and review ssh or autossh processes using reverse forwarding. OpenSourceMalware’s published indicators include hashes for matching the altered JavaScript file.

If the extension ran, isolate the host, preserve evidence, and block the server on ports 22 and 8099. Remove persistence after collection, rotate exposed credentials from a clean device, and investigate follow-on access.

Uninstalling the extension alone cannot establish that the system is trustworthy. Teams should also review authentication, shell, editor, process, and network logs before deciding whether rebuilding the affected machine is necessary to restore confidence in security.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Weaponized Claude Code Extension Gives Hackers Persistent Remote Access to Developer Systems appeared first on Cyber Security News.