Claude Code VS Code Extension Serves Persistent SSH Backdoor, Harvesting Developer Credentials

Claude Code VS Code Extension Serves Persistent SSH Backdoor, Harvesting Developer Credentials

What Happened — Researchers at macOS‑focused security firm Phorion discovered that a tampered build of Anthropic’s Claude Code extension (version 2.1.313) published on the Open VSX marketplace contained a malicious payload. The injected JavaScript runs immediately when the extension loads, adds the attacker’s SSH public key to the user’s authorized_keys, and opens an outbound SSH tunnel that persists even after the editor is closed. Persistence mechanisms differ by OS (startup file on macOS, cron job on Linux, scheduled task or startup folder on Windows). The backdoor also reports host details, environment variables that resemble API tokens, and cloud‑provider credentials to a command‑and‑control server. The malicious package was only found on Open VSX; the official Microsoft Visual Studio Marketplace showed no such version.

Why It Matters for Trust & Control Assurance — The incident tests the control objective of third‑party software supply‑chain oversight; continuous monitoring of external components is essential to prove a defensible security posture.

Who Is Affected — Developers and organizations that install VS Code‑compatible extensions from Open VSX (including users of alternative editors such as Cursor or Windsurf) across all sectors.

Recommended Actions

• Remove the compromised Claude Code extension immediately and replace it with a version from the official Visual Studio Marketplace.
• Conduct an inventory of all third‑party extensions, verify their provenance, and enforce a policy that only approved sources are used.
• Review authorized_keys and scheduled tasks for unknown entries; rotate SSH keys and revoke any exposed cloud credentials.
• Deploy endpoint detection that can flag unauthorized SSH tunnels and anomalous outbound connections.
• Integrate continuous supply‑chain monitoring into your audit evidence collection.

Technical Notes — Attack vector: malicious third‑party VS Code extension (supply‑chain compromise). Persistence via startup items, cron, or scheduled tasks. Data exfiltrated: hostname, username, OS, directories, Git email, public IP, up to 40 environment variables (potential API keys, cloud tokens). No CVE; the malicious code was injected into the extension bundle. Source: Help Net Security