{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"R\u00fcndajad suutsid sisestada pahavara ametlikku Claude Code'i laiendusse VS Code'ile","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

On tuvastatud Anthropic poolt v\u00e4lja antud Claude Code ametliku laienduse kompromiteerimine VS Code'i jaoks, millel on 63 miljonit allalaadimist. R\u00fcndajatel \u00f5nnestus Open-VSX kataloogis paigutada kahjuliku koodiga versioon anthropic.claude-code@2.1.313, mis v\u00f5imaldas kaugjuurdep\u00e4\u00e4su kasutaja s\u00fcsteemile. Kahjuliku paketi jagamine Microsofti hoidlas ei ole kinnitatud, kuid selle jaoks on samuti koostatud hoiatus. Problemaatiline versioon on praegu eemaldatud Open-VSX hoidlast ja sellele j\u00e4rgneb parandav versioon 2.1.314.<\/p>\n

Kood kahjulike komponentide laadimiseks lisati faili extension.js algusesse ja see aktiveeriti laienduse initsialiseerimise ajal p\u00e4rast VS Code'i k\u00e4ivitamist (kahjuliku koodi aktiveerimiseks ei olnud vaja kasutaja sekkumist Claude'iga). Kahjulik tegevus piirdus katalooge ~\/.ssh loomise ja faili ~\/.ssh\/authorized_keys lisamisega ssh-ed25519 avaliku v\u00f5tmega m\u00e4rkusega \u00absvc-telemetry\u00bb. P\u00e4rast seda kontrolliti Linuxis ja macOS-is, kas taustal on sshd-protsess, ja k\u00e4ivitati SSH-server, kui seda ei olnud. Windowsis toimus OpenSSH installimine PowerShelli kaudu. <\/p>\n

Seej\u00e4rel salvestas kahjulik kood privaatv\u00f5tme ajutisse faili nimega \u00ab.stk_*\u00bb ja seadistas tagasikanalit v\u00e4lisele SSH-serverile 134.209.82.225 kaugjuurdep\u00e4\u00e4su jaoks, k\u00e4ivitades ssh valikutega \u00ab-N -R \u2018*:0:localhost:22\u2019\u00bb. \u00dchendus uuendati iga 60 sekundi j\u00e4rel. Tunnelite v\u00e4rskendamiseks ja andmete edastamiseks v\u00e4listele serverid<\/a> salvestati failidesse ~\\\/ .config\\\/ .smt ja ~\\\/ .config\\\/ .smtk. Ajakava perioodiline k\u00e4ivitamine Linuxis seadistati cron'i kaudu, macOS-is LaunchAgent'i kaudu (com.apple.sysmond.plist), ning Windowsis SysMon'i ja automaatse k\u00e4ivitamise kaudu.<\/p>\n

Peale selle koguti s\u00fcsteemis teavet hostinime, registreeritud kasutajate, operatsioonis\u00fcsteemi, kodukatalooge, e-posti (git config --global user.email kaudu) ja keskkonnamuutujate kohta, mille nimed sisaldasid s\u00f5nu KEY, TOKEN, SECRET, PASS, AWS ja GCP. Leitud andmed edastati JSON-vormingus URL-ile http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

Claude Code'i kasutajatele VS Code'is soovitatakse kontrollida oma s\u00fcsteeme kahjuliku versiooni 2.1.313 olemasolu osas. S\u00fcsteemi kompromiteerimise indikaatoriteks on failide ilmumine ~\\\/ .config\\\/ .smt, ~\\\/ .config\\\/ .smtk, ~\\\/Library\\\/LaunchAgents\\\/com.apple.sysmond.plist, ${TMPDIR}\\\/ .stk_*, ~\\\/ .config\\\/ smt.cmd,
\n~\\\/ .config\\\/ smtk, SysMon ja sysmon.cmd, samuti \u00fchendused portidega 22 ja 8099. IP-aadressiga<\/a> 134.209.82.225, ja HTTP\/HTTPS-p\u00e4ringute saatmine hostidesse ifconfig.me ja api.ipify.org.<\/p>\n

Kuidas t\u00e4pselt kurjategijad said sisestada pahavara koodi lisandisse, ei ole veel selge, kuid arvatakse, et Anthropic'u t\u00f6\u00f6taja, kes haldab paketti, konto v\u00f5idi h\u00e4kkida v\u00f5i oli kasutusel turvaprobleem v\u00e4ljaandmis\u00fcsteemis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcndajad suutsid sisestada pahavara koodi ametlikku Claude Code'i lisandisse VS Code'i jaoks | ProHoster","description":"On fikseeritud ametliku Claude Code lisandi kompromiteerimine VS Code'i jaoks, mille on v\u00e4ljaandnud Anthropic ja mida on alla laaditud 63 miljonit korda.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}