{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"\u00dato\u010dn\u00edci se dok\u00e1zali infiltrovat do ofici\u00e1ln\u00edho roz\u0161\u00ed\u0159en\u00ed Claude Code pro VS Code a vlo\u017eit do n\u011bj \u0161kodliv\u00fd k\u00f3d.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byla zaznamen\u00e1na kompromitace ofici\u00e1ln\u00edho dopl\u0148ku Claude Code pro VS Code, dod\u00e1van\u00e9ho spole\u010dnost\u00ed Anthropic a p\u0159itahuj\u00edc\u00edho 63 milion\u016f sta\u017een\u00ed. \u00dato\u010dn\u00edk\u016fm se poda\u0159ilo um\u00edstit do adres\u00e1\u0159e Open-VSX verzi anthropic.claude-code@2.1.313, kter\u00e1 obsahovala \u0161kodliv\u00fd k\u00f3d pro vzd\u00e1len\u00fd p\u0159\u00edstup k syst\u00e9mu u\u017eivatele. Publikace \u0161kodliv\u00e9 verze bal\u00ed\u010dku v repozit\u00e1\u0159i Microsoft nebyla potvrzena, ale byl pro n\u011bj tak\u00e9 vytvo\u0159en varovn\u00fd report. V sou\u010dasn\u00e9 dob\u011b byla problematick\u00e1 verze odstran\u011bna z repozit\u00e1\u0159e Open-VSX a n\u00e1sledn\u011b byla publikov\u00e1na opravn\u00e1 verze 2.1.314.<\/p>\n

K\u00f3d pro na\u010dten\u00ed \u0161kodliv\u00fdch komponent\u016f byl p\u0159id\u00e1n na za\u010d\u00e1tek souboru extension.js a aktivoval se p\u0159i inicializaci dopl\u0148ku po spu\u0161t\u011bn\u00ed VS Code (k aktivaci \u0161kodliv\u00e9ho k\u00f3du nebyla vy\u017eadov\u00e1na interakce u\u017eivatele s Claudem). \u0160kodliv\u00e1 aktivita spo\u010d\u00edvala ve vytvo\u0159en\u00ed adres\u00e1\u0159e ~\/.ssh a p\u0159id\u00e1n\u00ed otev\u0159en\u00e9ho kl\u00ed\u010de ssh-ed25519 s pozn\u00e1mkou \u201esvc-telemetry\u201c do souboru ~\/.ssh\/authorized_keys. Pot\u00e9 byla provedena kontrola, zda b\u011b\u017e\u00ed proces sshd v Linuxu a macOS, a aktivace SSH serveru v p\u0159\u00edpad\u011b jeho nep\u0159\u00edtomnosti. Ve Windows bylo prost\u0159ednictv\u00edm PowerShellu nainstalov\u00e1no OpenSSH. <\/p>\n

N\u00e1sledn\u011b \u0161kodliv\u00fd k\u00f3d ulo\u017eil soukrom\u00fd kl\u00ed\u010d do do\u010dasn\u00e9ho souboru s n\u00e1zvem \u201e.stk_*\u201c a nastavil zp\u011btn\u00fd tunel s extern\u00edm SSH serverem 134.209.82.225 pro vzd\u00e1len\u00fd p\u0159\u00edstup, spou\u0161t\u011bn\u00edm ssh s volbami \u201e-N -R \u2018*:0:localhost:22\u2019\u201c. P\u0159ipojen\u00ed se obnovovalo ka\u017ed\u00fdch 60 sekund. Skripty pro aktualizaci tunelu a odes\u00edl\u00e1n\u00ed dat na extern\u00ed server byly tak\u00e9 vytvo\u0159eny. servery<\/a> se uchov\u00e1valy v souborech ~\/.config\/.smt a ~\/.config\/.smtk. Periodick\u00e9 spou\u0161t\u011bn\u00ed v Linuxu se nastavovalo pomoc\u00ed cron, v macOS pomoc\u00ed LaunchAgent (com.apple.sysmond.plist) a ve Windows pomoc\u00ed SysMon a automatick\u00e9ho spu\u0161t\u011bn\u00ed.<\/p>\n

Krom\u011b toho syst\u00e9m shroma\u017e\u010foval informace o n\u00e1zvu hostitele, registrovan\u00fdch u\u017eivatel\u00edch, opera\u010dn\u00edm syst\u00e9mu, dom\u00e1c\u00edm adres\u00e1\u0159i, emailu (prost\u0159ednictv\u00edm git config \u2014global user.email) a prom\u011bnn\u00fdch prost\u0159ed\u00ed s n\u00e1zvy obsahuj\u00edc\u00edmi slova KEY, TOKEN, SECRET, PASS, AWS a GCP. Nalezen\u00e1 data byla odesl\u00e1na ve form\u00e1tu JSON na URL http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

U\u017eivatel\u016fm dopl\u0148ku Claude Code pro VS Code se doporu\u010duje zkontrolovat sv\u00e9 syst\u00e9my, zda nemaj\u00ed nainstalovanou \u0161kodlivou verzi 2.1.313. Indik\u00e1tory kompromitace syst\u00e9mu zahrnuj\u00ed vznik soubor\u016f ~\/.config\/.smt, ~\/.config\/.smtk, ~\/.Library\/LaunchAgents\/com.apple.sysmond.plist, ${TMPDIR}\/.stk_*, ~\/.config\/smt.cmd,
\n~\/ .config\/smtk, SysMon a sysmon.cmd, a tak\u00e9 p\u0159\u00edstup na porty 22 a 8099 k IP adresu<\/a> 134.209.82.225, a odes\u00edl\u00e1n\u00ed HTTP\/HTTPS po\u017eadavk\u016f na hostitele ifconfig.me a api.ipify.org.<\/p>\n

Jak p\u0159esn\u011b \u00fato\u010dn\u00edci dos\u00e1hli vlo\u017een\u00ed \u0161kodliv\u00e9ho k\u00f3du do dopl\u0148ku, zat\u00edm nen\u00ed jasn\u00e9. P\u0159edpokl\u00e1d\u00e1 se, \u017ee mohla b\u00fdt hacknuta \u00fa\u010det zam\u011bstnance spole\u010dnosti Anthropic, kter\u00fd se zab\u00fdv\u00e1 \u00fadr\u017ebou bal\u00ed\u010dku, nebo mohla b\u00fdt vyu\u017eita bezpe\u010dnostn\u00ed chyba v syst\u00e9mu publikov\u00e1n\u00ed verz\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00dato\u010dn\u00edci dok\u00e1zali vlo\u017eit \u0161kodliv\u00fd k\u00f3d do ofici\u00e1ln\u00edho dopl\u0148ku Claude Code pro VS Code | ProHoster","description":"Byla zaznamen\u00e1na kompromitace ofici\u00e1ln\u00edho dopl\u0148ku Claude Code pro VS Code, kter\u00fd poskytuje spole\u010dnost Anthropic a kter\u00fd m\u00e1 63 milion\u016f sta\u017een\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}