Attackers were able to inject malicious code into the official Claude Code extension for VS Code

A compromise has been detected in the official Claude Code extension for VS Code, provided by Anthropic and downloaded 63 million times. Attackers managed to place the release anthropic.claude-code@2.1.313, containing malicious code for remote access to the user's system, in the Open-VSX directory. The publication of the malicious version of the package in the Microsoft repository has not been confirmed, but a report has been generated with a warning. The problematic version has been removed from the Open-VSX repository, and a corrective release 2.1.314 has been published.

The code for downloading malicious components was added to the beginning of the file extension.js and activated during the initialization of the extension after launching VS Code (user interaction with Claude was not required to activate the malicious code). The malicious activity involved creating the directory ~/.ssh and adding the ssh-ed25519 public key to the file ~/.ssh/authorized_keys with the note "svc-telemetry." Following this, it checked for the sshd background process in Linux and macOS, activating the SSH server if it was absent. In Windows, OpenSSH was installed via PowerShell.

The malicious code then saved a private key to a temporary file named ".stk_*" and configured a reverse tunnel to the external SSH server 134.209.82.225 for remote access, running ssh with the options "-N -R '*:0:localhost:22'". The connection was refreshed every 60 seconds. Scripts for updating the tunnel and sending data to external servers were saved in the files ~/.config/.smt and ~/.config/.smtk. Periodic launches in Linux were configured through cron, in macOS through LaunchAgent (com.apple.sysmond.plist), and in Windows through SysMon and autostart.

Additionally, the system collected information about the hostname, registered users, operating system, home directory, email (via git config --global user.email), and environment variables with names containing the words KEY, TOKEN, SECRET, PASS, AWS, and GCP. The found data was sent in JSON format to the URL http://134.209.82.225:8099/beacon.

Users of the Claude Code extension for VS Code are advised to check their systems for the malicious version 2.1.313. Indicators of system compromise include the appearance of the files ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist, ${TMPDIR}/.stk_*, ~/.config/smt.cmd,
~/config/smtk, SysMon, and sysmon.cmd, as well as access on ports 22 and 8099 to IP address 134.209.82.225, and sending HTTP/HTTPS requests to hosts ifconfig.me and api.ipify.org.

It is still unclear how exactly the attackers managed to insert malicious code into the add-on; it is believed that a staff member's Anthropic account, responsible for maintaining the package, may have been compromised, or a security issue in the release publishing system was exploited.

Source: opennet.ru