A Claude Code for VS Code, provided by Anthropic and with 63 million downloads, was compromised. Attackers managed to place a release anthropic.claude-code@2.1.313 in the Open-VSX directory, containing malicious code for remote access to the user's system. The publication of the malicious version of the package in the Microsoft repository has not been confirmed, but a warning report has also been generated for it. The problematic version has now been removed from the Open-VSX repository, and a corrective release 2.1.314 has been published.
Code to download malicious components was added at the beginning of the extension.js file and activated upon the initialization of the extension after VS Code was launched (user interaction with Claude was not required to activate the malicious code). Malicious activity consisted of creating the directory ~\/ .ssh and adding the ssh-ed25519 public key to the file ~\/ .ssh\/ authorized_keys with the note "svc-telemetry". After that, it checked for the presence of a background sshd process in Linux and macOS, and activated the SSH server if it was absent. In Windows, OpenSSH was installed via PowerShell.
Further, the malicious code saved the private key to a temporary file named ".stk_*" and set up a reverse tunnel to an external SSH server 134.209.82.225 for remote access, running ssh with the options "-N -R '*:0:localhost:22'". The connection was refreshed every 60 seconds. Scripts for updating the tunnel and sending data to external szerverek were stored in the files ~\/ .config\/ .smt and ~\/ .config\/ .smtk. Periodic launching in Linux was set up via cron, in macOS through LaunchAgent (com.apple.sysmond.plist), and in Windows through SysMon and autostart.
In addition, information was collected in the system about the host name, registered users, operating system, home directory, email (via git config --global user.email), and environment variables with names containing the words KEY, TOKEN, SECRET, PASS, AWS, and GCP. The found data was sent in JSON format to the URL http:\/\/134.209.82.225:8099\/beacon.
Users of the Claude Code for VS Code are recommended to check their systems for the installation of the malicious version 2.1.313. Indicators of system compromise include the presence of files ~\/ .config\/ .smt, ~\/ .config\/ .smtk, ~\/ Library\/ LaunchAgents\/ com.apple.sysmond.plist, ${TMPDIR}\/ .stk_*, ~\/ .config\/ smt.cmd,
~\/ .config\/ smtk, SysMon and sysmon.cmd, as well as connections to ports 22 and 8099. IP-cím alapján határozza meg a helyet 134.209.82.225, és HTTP/HTTPS kérések küldése az ifconfig.me és api.ipify.org hosztokhoz.
Azt még nem tudni pontosan, hogyan sikerült a támadóknak rosszindulatú kódot beilleszteni a kiegészítőbe, feltételezik, hogy egy Anthropic-nál dolgozó alkalmazott fiókját feltörték, vagy a kiadási rendszer biztonsági problémáját használták ki.
Forrás: opennet.ru
