A Trusted AI Tool Was Weaponised: Inside the Trojanized Claude Code Extension Attack

Illustration: Abstract representation of developer tool compromise. Photo: Unsplash

On October 30, 2026, security researchers revealed that a trojanized version of the Claude Code Visual Studio Code extension was published to the open-source Open-VSX extension registry. Distributed under the identifier [email protected] , the package harboured an embedded loader that converted infected developer machines into persistently accessible SSH remote backdoors.

This incident exposes a critical vulnerability in modern engineering workflows: the implicit trust developers grant to their local development tooling. Unlike web applications operating in sandboxed runtimes, code editor extensions inherit the user’s execution privileges, execute shell commands, access local files, and inspect environment variables. AI coding assistants are among the most eagerly adopted developer tools today, which makes weaponising their distribution channels an exceptionally high-yield supply-chain vector.

However, the narrative surrounding the breach requires careful factual parsing. While early disclosures from research firm OpenSourceMalware raised immediate alarms across the ecosystem, subsequent counter-evidence and statements from Anthropic confirmed that the compromise was confined to the Open-VSX registry sample; the primary Microsoft Visual Studio Code Marketplace release remained unaffected.

Technical Breakdown: Inside the Attack

The trojanized package exhibited a surgical approach to supply-chain compromise, mapped to MITRE ATT&CK techniques including Supply Chain Compromise (T1195) and Modify Authentication Process (T1556).

The attackers modified the extension’s primary entry point, extension.js , by prepending a 66-line Immediately Invoked Function Expression (IIFE) ahead of the authentic bundled code. The payload executed automatically as soon as VS Code activated the extension runtime, requiring no active Claude conversation or developer prompt to trigger.

The loader performed six distinct operations:

1. Zero-Interaction Execution

The malicious code ran immediately upon VS Code loading the extension, not when a Claude conversation began. This placement ensured infection even if users never interacted with the extension. The script suppressed all exceptions, allowing the legitimate extension to load normally while malicious operations failed silently.

2. Host Reconnaissance

Within 1.5 seconds of execution, the loader gathered critical telemetry:

Hostname, local username, operating system, and CPU architecture

Current working directory and directory path

Global Git user email from git config --global user.email

Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP

While environment variable values were not transmitted in the initial HTTP beacon, cataloguing credential variable names allowed attackers to identify high-value targets for direct interactive exploration.

3. SSH Backdoor Installation

The loader appended an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys ,

It then attempted to enable SSH services: macOS checked Remote Login, Linux queried sshd with systemctl, and Windows used PowerShell to install OpenSSH Server.

4. Reverse SSH Tunnel

The script decoded an embedded base64 OpenSSH private key and launched a reverse SSH tunnel to 134.209.82.225:22 with port forwarding arguments -N -R '*:0:localhost:22' . The connection disabled host-key verification and reconnected every 60 seconds using autossh or ssh.

5. Platform-Specific Persistence

Attackers established durability across reboots:

macOS: User LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist with RunAtLoad and KeepAlive flags

Linux: Helper scripts in ~/.config/.smt with @reboot crontab entry

Windows: Scheduled Task “SysMon” running as SYSTEM, with fallback to Startup folder

The malware sent reconnaissance data via unencrypted HTTP POST requests to 127.0.0.1:8099/beacon and 134.209.82.225:8099/beacon . There were no additional malware downloads; the attack relied entirely on existing system utilities and embedded keys.

Factual Claims vs. Confirmed Findings

Implications for AI/ML Developer Security

This weaponisation of anthropic.claude-code highlights systemic security weaknesses across the developer tooling landscape:

The Extension Blind Spot: Developer extension ecosystems operate on an outdated trust model. VS Code extensions run with full Node.js system permissions, possess unmonitored filesystem and network access, and launch automatically at startup without user consent dialogs.

AI Tooling as High-Value Target: Modern developers configure local environments with administrative tokens for AWS, GCP, GitHub, and production databases. AI coding assistants are granted deep workspace permissions to edit code and run local commands, making them an ideal beachhead for corporate network intrusion.

Registry Fragmentation: While the official Microsoft VS Code Marketplace maintains stringent scanning, open alternative registries like Open-VSX face intense scrutiny regarding multi-factor publishing and automated behavioral vetting.

Compliance Risk: Under frameworks such as SOC 2 and ISO 27001, developer workstation compromises represent reportable security incidents. The speed with which compromised tools can propagate elevates marketplace security to an enterprise risk priority.

What Users and Teams Should Do Now

Organizations or developers who installed the Claude Code extension via Open-VSX must initiate immediate incident response:

Remove the Extension: Immediately uninstall anthropic.claude-code if obtained through Open-VSX.

Audit SSH Configurations: Inspect ~/.ssh/authorized_keys for any entries referencing svc-telemetry or the Ed25519 fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk .

Eradicate Persistence Artifacts: macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist , ~/.config/.smt , ~/.config/.smtk Linux: ~/.config/.smt , ~/.config/.smtk , and check crontab for @reboot entries Windows: Scheduled task “SysMon”, ~/.config/smt.cmd , ~/.config/smtk , and Startup folder files

macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist , ~/.config/.smt , ~/.config/.smtk

Linux: ~/.config/.smt , ~/.config/.smtk , and check crontab for @reboot entries

Windows: Scheduled task “SysMon”, ~/.config/smt.cmd , ~/.config/smtk , and Startup folder files

Block C2 Infrastructure: Block outbound traffic to IP 134.209.82.225 on ports 22 and 8099. Monitor for persistent processes matching autossh or ssh with reverse tunneling syntax.

Rotate Credentials: Treat all environment variables and local secrets as potentially compromised; rotate AWS, GCP, GitHub, and API keys from a verified clean machine.

Consider Host Rebuilds: Because an active reverse SSH tunnel allows attackers to execute arbitrary follow-on shell commands, rebuilding affected hosts is strongly advised.

Indicators of Compromise (IOCs)

Package: [email protected]

IP Address: 134.209.82.225

SSH Key : svc-telemetry

Persistence Files: ~/.config/.smt , ~/.config/.smtk , com.apple.sysmond.plist , sysmon.cmd , SysMon

Port: 134.209.82.225:8099 (HTTP beacon), 134.209.82.225:22 (SSH tunnel)

Paul McCarty (6mile), “Trojanized Claude Code Extension Plants an SSH Backdoor”, OpenSourceMalware, October 30, 2026.

The Verge, “Anthropic Official Statement on Claude Code Security Incident”, October 30, 2026.

Ars Technica, “Independent Technical Analysis: 66-Line Loader Patterns in OpenVSX Supply Chain”, October 30, 2026.

OpenVSX.org Blog, “Security Incident Disclosure & Remediation: [email protected] ”, October 30, 2026.

GitHub Security Advisory, CVE-2026-XXXXX (Pending).

MITRE ATT&CK Knowledge Base: Techniques T1195, T1556, T1071, T1547, T1082, T1046.

Brian Krebs, “A Wake-Up Call for Developer Extension Marketplaces”, Krebs on Security, October 31, 2026.

How this analysis is researched, sourced and corrected: Editorial standards and corrections . Spotted an error? Philip Hall .