# Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines

Trojanized Claude Code VS Code extension 2.1.313 on Open-VSX planted an SSH key, per-OS persistence, and a reverse SSH tunnel, beaconing host recon to attacker C2.

- Payout: Real-world hack
- Severity: critical
- Program: Anthropic
- Analysis by: StepSecurity
- Disclosed: 2026-10-30
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/claude-code-extension-trojanized
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-claude-code-extension-trojanized
- Tags: area:os domain:desktop domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:nodejs technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** VS Code extension (extension.js bundle) distributed via Open-VSX and Cursor marketplace
**Root cause:** A ~7KB malicious loader was embedded into the legitimate extension.js bundle of version 2.1.313, published under the legitimate Anthropic Open-VSX publisher identity. It executes under plain Node.js on module load with no VS Code APIs or lifecycle hooks required.
**Steps:**
1. Obtain anthropic.claude-code@2.1.313 (SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, 3,692,922 bytes) from Open-VSX or Cursor marketplace mirror.
2. Load the extension module in Node.js; the embedded loader in extension.js executes without any VS Code API call.
3. Loader appends attacker key `svc-telemetry` (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk) to ~/.ssh/authorized_keys and drops embedded private key as `$TMPDIR/.stk_*`.
4. Installs persistence: LaunchAgent `com.apple.sysmond.plist`, scheduled task `SysMon` (SYSTEM, onstart) via `schtasks /create /tn SysMon`, or cron `@reboot`; drops `~/.config/.smt`, `.smtk`, `smt.cmd`.
5. Enables remote login (`systemsetup -setremotelogin on`, `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0`) and opens reverse tunnel with `ssh -N -R '*:0:localhost:22'` / `autossh -M 0` (StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null).
6. Beacons host recon JSON via HTTP POST to `http://134.209.82.225:8099/beacon` (also attempted via loopback `127.0.0.1:8099/beacon`), collecting env var names matching KEY/TOKEN/SECRET/PASS/AWS/GCP.
**How found:** Registry and sandbox analysis: the malicious extension.js was ~7KB larger than the preceding clean release, and sandbox telemetry showed the payload executing under plain Node.js with no VS Code APIs, prompting IOC extraction and comparison against clean 2.1.312/2.1.314 builds.
**Exploitation:** Attacker published trojanized 2.1.313 to Open-VSX under the legitimate Anthropic publisher identity; it auto-mirrored to Cursor's marketplace, reaching up to 5,000 users in an 11-hour window. On load the loader planted an SSH key for interactive access, established per-OS persistence surviving extension removal, opened a reverse SSH tunnel to 134.209.82.225:22, and exfiltrated host recon over plain HTTP to port 8099.
**Escalation:** Persistence artifacts (LaunchAgent, SYSTEM scheduled task, cron @reboot) survive extension uninstall; beaconed env var names reveal which credentials (source-control, CI/CD, cloud, registry tokens) were present for follow-on theft.
**Insight:** Diff extension bundle sizes and grep installed extension.js for C2 IPs/SSH key comments; a loader embedded in a legitimate bundle executes on module load without any IDE API, so sandbox the extension module under plain Node.js rather than only exercising it through the editor.