{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"Uzbruc\u0113jiem izdev\u0101s ievad\u012bt \u013caunpr\u0101t\u012bgu kodu ofici\u0101laj\u0101 Claude Code papla\u0161in\u0101jum\u0101 VS Code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tika ir re\u0123istr\u0113ta ofici\u0101l\u0101 Claude Code papla\u0161in\u0101juma kompromit\u0101cija VS Code, ko pieg\u0101d\u0101 uz\u0146\u0113mums Anthropic un kura lejupiel\u0101\u017eu skaits ir 63 miljoni. Uzbruc\u0113jiem izdev\u0101s ievietot kataloga Open-VSX izlaidumu anthropic.claude-code@2.1.313, kas satur \u013caunpr\u0101t\u012bgu kodu att\u0101lin\u0101tai piek\u013cuvei lietot\u0101ja sist\u0113mai. \u013baunpr\u0101t\u012bg\u0101s versijas public\u0113\u0161ana Microsoft repozitorij\u0101 nav apstiprin\u0101ta, bet ar\u012b tam ir izveidots zi\u0146ojums ar br\u012bdin\u0101jumu. Pa\u0161laik probl\u0113matiskais izlaidums ir no\u0146emts no Open-VSX repozitorija, un p\u0113c tam ir public\u0113ts labojums 2.1.314.<\/p>\n

Kods, kas paredz\u0113ts \u013caunpr\u0101t\u012bgu komponentu ievieto\u0161anai, tika pievienots faila extension.js s\u0101kumam un aktiviz\u0113j\u0101s, kad tika iel\u0101d\u0113ts papla\u0161in\u0101jums p\u0113c VS Code palai\u0161anas (lietot\u0101ja mijiedarb\u012bba ar Claude, lai aktiviz\u0113tu \u013caunpr\u0101t\u012bgo kodu, nebija nepiecie\u0161ama). \u013baunpr\u0101t\u012bg\u0101 darb\u012bba bija ierobe\u017eota ar direktorijas ~\/.ssh izveidi un ssh-ed25519 atsl\u0113gas pievieno\u0161anu failam ~\/.ssh\/authorized_keys ar piez\u012bmi \u00absvc-telemetry\u00bb. P\u0113c tam tika p\u0101rbaud\u012bta fona procesa sshd kl\u0101tb\u016btne Linux un macOS, un SSH serveris tika aktiviz\u0113ts, ja tas nebija kl\u0101t. Windows vid\u0113 caur PowerShell tika uzst\u0101d\u012bts OpenSSH. <\/p>\n

T\u0101l\u0101k \u013caunpr\u0101t\u012bgais kods saglab\u0101ja priv\u0101to atsl\u0113gu pagaidu fail\u0101 ar nosaukumu \u00ab.stk_*\u00bb un konfigur\u0113ja atpaka\u013cejo\u0161o tuneli ar \u0101r\u0113ju SSH serveri 134.209.82.225 att\u0101lin\u0101tai piek\u013cuvei, palai\u017eot ssh ar opcij\u0101m \u00ab-N -R '*:0:localhost:22'\u00bb. Savienojums tika atjaunots ik p\u0113c 60 sekund\u0113m. Skripti tunela atjaunin\u0101\u0161anai un datu nos\u016bt\u012b\u0161anai uz \u0101r\u0113jiem serverus<\/a> tika saglab\u0101ti failos ~\/.config\/.smt un ~\/.config\/.smtk. Periodiska palai\u0161ana Linux tika konfigur\u0113ta caur cron, macOS caur LaunchAgent (com.apple.sysmond.plist), bet Windows caur SysMon un autom\u0101tisko palai\u0161anu.<\/p>\n

Turkl\u0101t sist\u0113m\u0101 tika v\u0101kti dati par hosta nosaukumu, re\u0123istr\u0113tajiem lietot\u0101jiem, oper\u0113jo\u0161o sist\u0113mu, m\u0101jas katalogu, e-pastu (caur git config \u2014global user.email) un vides main\u012bgajiem ar nosaukumiem, kas satur v\u0101rdus KEY, TOKEN, SECRET, PASS, AWS un GCP. Atrastie dati tika nos\u016bt\u012bti JSON form\u0101t\u0101 uz URL http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

Claude Code papla\u0161in\u0101juma VS Code lietot\u0101jiem ieteicams p\u0101rbaud\u012bt savus sist\u0113mas pret \u013caunpr\u0101t\u012bg\u0101s versijas 2.1.313 uzst\u0101d\u012b\u0161anu. Sist\u0113mas kompromit\u0101cijas r\u0101d\u012bt\u0101ji ir failu par\u0101d\u012b\u0161an\u0101s ~\/.config\/.smt, ~\/.config\/.smtk, ~\/Library\/LaunchAgents\/com.apple.sysmond.plist, ${TMPDIR}\/.stk_*, ~\/.config\/smt.cmd,
\n~\/.config\/smtk, SysMon un sysmon.cmd, k\u0101 ar\u012b piek\u013cuve caur portiem 22 un 8099 uz IP adresi<\/a> 134.209.82.225, un HTTP\/HTTPS piepras\u012bjumu nos\u016bt\u012b\u0161ana uz hostiem ifconfig.me un api.ipify.org.<\/p>\n

Nav skaidrs, k\u0101 tie\u0161i uzbruc\u0113ji izdev\u0101s iek\u013caut kait\u012bgu kodu papildin\u0101jum\u0101, ta\u010du tiek uzskat\u012bts, ka var\u0113ja tikt uzlauzta Anthropic darbinieka, kur\u0161 uzrauga pakotni, konts vai ar\u012b tika izmantota dro\u0161\u012bbas probl\u0113ma izlaidumu public\u0113\u0161anas sist\u0113m\u0101.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uzbruc\u0113ji sp\u0113ja ievietot kait\u012bgu kodu ofici\u0101laj\u0101 papildin\u0101jum\u0101 Claude Code VS Code | ProHoster","description":"Ir konstat\u0113ta ofici\u0101l\u0101 papildin\u0101juma Claude Code kompromit\u0101cija VS Code, ko pieg\u0101d\u0101 uz\u0146\u0113mums Anthropic un kas ir lejupiel\u0101d\u0113ts 63 miljonus rei\u017eu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}