{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"Angriberne lykkedes at inds\u00e6tte skadelig kode i den officielle Claude Code-udvidelse til VS Code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Der er registreret en kompromittering af det officielle Claude Code-udvidelse til VS Code, der leveres af Anthropic og har 63 millioner downloads. Angriberen lykkedes med at placere udgivelsen anthropic.claude-code@2.1.313 i Open-VSX kataloget, som indeholdt ondsindet kode til fjernadgang til brugerens system. Publiceringen af den ondsindede version af pakken i Microsofts repository er ikke bekr\u00e6ftet, men der er ogs\u00e5 udarbejdet en rapport med en advarsel for den. Den problematiske version er nu fjernet fra Open-VSX repositoryet, og en korrektionsudgivelse 2.1.314 er blevet offentliggjort.<\/p>\n

Koden til at downloade skadelige komponenter blev tilf\u00f8jet i starten af filen extension.js og aktiveret ved initialisering af udvidelsen efter opstart af VS Code (der kr\u00e6vedes ikke brugerinteraktion med Claude for at aktivere den skadelige kode). Den skadelige aktivitet bestod i at oprette en mappe ~\/.ssh og tilf\u00f8je den offentlige ssh-ed25519 n\u00f8gle til filen ~\/.ssh\/authorized_keys med bem\u00e6rkningen \u00absvc-telemetry\u00bb. Herefter blev der kontrolleret for tilstedev\u00e6relsen af baggrundsprocessen sshd i Linux og macOS, og SSH-serveren blev aktiveret i tilf\u00e6lde af, at den ikke var til stede. I Windows blev OpenSSH installeret via PowerShell. <\/p>\n

Derefter gemte den skadelige kode den private n\u00f8gle i en midlertidig fil med navnet \u00ab.stk_*\u00bb og opsatte en omvendt tunnel til den eksterne SSH-server 134.209.82.225 for fjernadgang, ved at k\u00f8re ssh med indstillingerne \u00ab-N -R \u2018*:0:localhost:22\u2019\u00bb. Forbindelsen blev opdateret hvert 60. sekund. Skripter til opdatering af tunnelen og for sending af data til eksterne servere<\/a> blev gemt i filerne ~\/.config\/.smt og ~\/.config\/.smtk. Periodisk k\u00f8rsel i Linux blev indstillet via cron, i macOS via LaunchAgent (com.apple.sysmond.plist), og i Windows via SysMon og autostart.<\/p>\n

Derudover blev der samlet oplysninger i systemet om v\u00e6rtsnavn, registrerede brugere, operativsystem, hjemmebibliotek, email (via git config \u2014global user.email) og om milj\u00f8variabler med navne, der indeholdt ordene KEY, TOKEN, SECRET, PASS, AWS og GCP. De fundne data blev sendt i JSON-format til URL http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

Brugere af Claude Code-udvidelsen til VS Code anbefales at tjekke deres systemer for installation af den ondsindede version 2.1.313. Indikatorer for systemkompromittering inkluderer tilstedev\u00e6relsen af filer ~\/.config\/.smt, ~\/.config\/.smtk, ~\/.Library\/LaunchAgents\/com.apple.sysmond.plist, ${TMPDIR}\/.stk_*, ~\/.config\/smt.cmd,
\n~\/ .config\/smtk, SysMon, og sysmon.cmd, samt adgang til porte 22 og 8099. IP-adressen<\/a> 134.209.82.225, og afsendelse af HTTP\/HTTPS-anmodninger til v\u00e6rter ifconfig.me og api.ipify.org.<\/p>\n

Hvordan angriberne pr\u00e6cist opn\u00e5ede at inds\u00e6tte ondsindet kode i till\u00e6gget er endnu uklart. Det antages, at en medarbejders konto hos Anthropic, som h\u00e5ndterer pakken, kunne v\u00e6re blevet kompromitteret, eller at en s\u00e5rbarhed i releasesystemet blev udnyttet.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Angriberne form\u00e5ede at inds\u00e6tte ondsindet kode i det officielle till\u00e6g Claude Code til VS Code | ProHoster","description":"Der er registreret en kompromittering af det officielle till\u00e6g Claude Code til VS Code, der leveres af Anthropic og har haft 63 millioner downloads.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}