Malicious Claude Code VSCode Extension Plants SSH Backdoor

A malicious version of the Claude Code extension for Visual Studio Code, version 2.1.313, was discovered to contain a backdoor. This trojanized extension, published on the Open-VSX registry, inserts a loader that executes before the legitimate code. The malicious loader adds an attacker-controlled SSH key, attempts to enable the local SSH service, and establishes a reverse tunnel to a command-and-control server at 134.209.82.225. AI

IMPACT Compromised developer tools can lead to supply chain attacks, impacting AI development workflows and potentially exposing sensitive data.

RANK_REASON This is a security vulnerability in a third-party tool that integrates with an AI product, not a direct release from an AI lab.

Read on HN — claude cli stories →

• 134.209.82.225
• 2.1.313
• .anthropic
• Claude Code
• Igor S Kofman
• Javascript
• Microsoft VSCode
• Node.js
• Open VSX
• Secure Shell
• Visual Studio Code

• product
• safety

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →