{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"A t\u00e1mad\u00f3knak siker\u00fclt k\u00e1rt\u00e9kony k\u00f3dot integr\u00e1lniuk a VS Code hivatalos Claude Code kieg\u00e9sz\u00edt\u0151j\u00e9be","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Claude Code for VS Code, provided by Anthropic and with 63 million downloads, was compromised. Attackers managed to place a release anthropic.claude-code@2.1.313 in the Open-VSX directory, containing malicious code for remote access to the user's system. The publication of the malicious version of the package in the Microsoft repository has not been confirmed, but a warning report has also been generated for it. The problematic version has now been removed from the Open-VSX repository, and a corrective release 2.1.314 has been published.<\/p>\n

A rosszindulat\u00fa \u00f6sszetev\u0151k bet\u00f6lt\u00e9s\u00e9re szolg\u00e1l\u00f3 k\u00f3d az extension.js f\u00e1jl elej\u00e9hez ker\u00fclt, \u00e9s az kieg\u00e9sz\u00edt\u0151 inicializ\u00e1l\u00e1sakor aktiv\u00e1l\u00f3dott a VS Code ind\u00edt\u00e1sa ut\u00e1n (a rosszindulat\u00fa k\u00f3d aktiv\u00e1l\u00e1s\u00e1hoz nem volt sz\u00fcks\u00e9ges a felhaszn\u00e1l\u00f3 interakci\u00f3ja Claude-dal). A rosszindulat\u00fa tev\u00e9kenys\u00e9g \u00f6sszefoglal\u00e1sa a ~\/.ssh k\u00f6nyvt\u00e1r l\u00e9trehoz\u00e1s\u00e1ra \u00e9s a ~\/.ssh\/authorized_keys f\u00e1jlba egy ssh-ed25519 nyilv\u00e1nos kulcs hozz\u00e1ad\u00e1s\u00e1ra korl\u00e1toz\u00f3dott, amelyhez a \u201esvc-telemetry\u201d megjegyz\u00e9st f\u0171zt\u00e9k. Ezt k\u00f6vet\u0151en ellen\u0151rz\u00e9sre ker\u00fclt a sshd h\u00e1tt\u00e9rfolyamat l\u00e9tez\u00e9se Linux \u00e9s macOS rendszerekben, \u00e9s SSH-szerver aktiv\u00e1l\u00e1sa, ha az nem volt el\u00e9rhet\u0151. Windows alatt PowerShell-en kereszt\u00fcl az OpenSSH telep\u00edt\u00e9se t\u00f6rt\u00e9nt. <\/p>\n

Ezut\u00e1n a rosszindulat\u00fa k\u00f3d a titkos kulcsot .stk_* nev\u0171 ideiglenes f\u00e1jlba mentette, \u00e9s be\u00e1ll\u00edtotta a visszautas\u00edt\u00e1st egy k\u00fcls\u0151 SSH-szerverhez, a 134.209.82.225-hez, t\u00e1voli hozz\u00e1f\u00e9r\u00e9s c\u00e9lj\u00e1b\u00f3l, az ssh -N -R '*:0:localhost:22' opci\u00f3ival futtatva. A kapcsolat 60 m\u00e1sodpercenk\u00e9nt friss\u00fclt. A csatorna friss\u00edt\u00e9s\u00e9re \u00e9s adatk\u00fcld\u00e9sre szolg\u00e1l\u00f3 szkriptek k\u00fcls\u0151 szerverek<\/a> were stored in the files ~\\\/ .config\\\/ .smt and ~\\\/ .config\\\/ .smtk. Periodic launching in Linux was set up via cron, in macOS through LaunchAgent (com.apple.sysmond.plist), and in Windows through SysMon and autostart.<\/p>\n

Ezen k\u00edv\u00fcl a rendszerben inform\u00e1ci\u00f3k gy\u0171ltek a hosztnevr\u0151l, a regisztr\u00e1lt felhaszn\u00e1l\u00f3kr\u00f3l, az oper\u00e1ci\u00f3s rendszerr\u0151l, a szem\u00e9lyes k\u00f6nyvt\u00e1rr\u00f3l, az email c\u00edmr\u0151l (git config \u2014global user.email) \u00e9s a k\u00f6rnyezeti v\u00e1ltoz\u00f3kr\u00f3l, amelyek nevei KEY, TOKEN, SECRET, PASS, AWS \u00e9s GCP szavakat tartalmaztak. Az ilyen t\u00edpus\u00fa adatokat JSON form\u00e1tumban k\u00fcldt\u00e9k a http:\/\/134.209.82.225:8099\/beacon URL-re.<\/p>\n

Users of the Claude Code for VS Code are recommended to check their systems for the installation of the malicious version 2.1.313. Indicators of system compromise include the presence of files ~\\\/ .config\\\/ .smt, ~\\\/ .config\\\/ .smtk, ~\\\/ Library\\\/ LaunchAgents\\\/ com.apple.sysmond.plist, ${TMPDIR}\\\/ .stk_*, ~\\\/ .config\\\/ smt.cmd,
\n~\\\/ .config\\\/ smtk, SysMon and sysmon.cmd, as well as connections to ports 22 and 8099. IP-c\u00edm alapj\u00e1n hat\u00e1rozza meg a helyet<\/a> 134.209.82.225, \u00e9s HTTP\/HTTPS k\u00e9r\u00e9sek k\u00fcld\u00e9se az ifconfig.me \u00e9s api.ipify.org hosztokhoz.<\/p>\n

Azt m\u00e9g nem tudni pontosan, hogyan siker\u00fclt a t\u00e1mad\u00f3knak rosszindulat\u00fa k\u00f3dot beilleszteni a kieg\u00e9sz\u00edt\u0151be, felt\u00e9telezik, hogy egy Anthropic-n\u00e1l dolgoz\u00f3 alkalmazott fi\u00f3kj\u00e1t felt\u00f6rt\u00e9k, vagy a kiad\u00e1si rendszer biztons\u00e1gi probl\u00e9m\u00e1j\u00e1t haszn\u00e1lt\u00e1k ki.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A t\u00e1mad\u00f3k be tudt\u00e1k illeszteni a rosszindulat\u00fa k\u00f3dot a VS Code-hoz k\u00e9sz\u00fclt hivatalos Claude Code kieg\u00e9sz\u00edt\u0151be | ProHoster","description":"Kiberv\u00e9delmi incidens t\u00f6rt\u00e9nt a Claude Code hivatalos kieg\u00e9sz\u00edt\u0151je ellen a VS Code-hoz, amelyet az Anthropic sz\u00e1ll\u00edt, \u00e9s 63 milli\u00f3 let\u00f6lt\u00e9ssel b\u00edr.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}