Weaponized Claude Code Extension on Open VSX Installs Persistent SSH Backdoor

OpenSourceMalware identified a weaponized anthropic.claude-code extension, version 2.1.313, on Open VSX that attempts to give attackers persistent SSH access to developer systems. A JavaScript loader prepended to the extension bundle installs an attacker-controlled SSH key, attempts to enable SSH services where permissions allow, and establishes a reverse tunnel to 134.209.82.225. It also collects system metadata and transmits it over unencrypted HTTP to port 8099. A separate Phorion advisory reported a backdoor in the Claude Code bundle on Open VSX, but its supplied excerpt provided no affected versions or indicators.

The analyzed sample targeted macOS on Apple Silicon; additional Linux and Windows persistence code does not establish successful infections on those platforms. The findings demonstrate a malicious Open VSX artifact, not a confirmed compromise of Anthropic’s official Visual Studio Marketplace release or wider distribution infrastructure. Organizations should identify and isolate systems where the affected extension ran, preserve evidence, investigate SSH keys, services, tunnels, and operating-system persistence, and rotate potentially exposed credentials from a clean device. Uninstalling the extension alone is insufficient because attacker access may persist independently.