{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"Atacatorii au reu\u0219it s\u0103 integreze cod r\u0103u inten\u021bionat \u00een extensia oficial\u0103 Claude Code pentru VS Code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A fost detectat\u0103 compromiterea extensiei oficiale Claude Code pentru VS Code, furnizat\u0103 de compania Anthropic, cu 63 de milioane de desc\u0103rc\u0103ri. Atacatorilor le-a reu\u0219it s\u0103 plaseze \u00een catalogul Open-VSX o versiune a anthropic.claude-code@2.1.313, con\u021bin\u00e2nd cod mali\u021bios pentru accesul la sistemul utilizatorului. Publicarea versiunii mali\u021bioase a pachetului \u00een repositoarele Microsoft nu a fost confirmat\u0103, dar a fost redactat un raport de avertizare. \u00cen prezent, versiunea problematic\u0103 a fost eliminat\u0103 din repositoarele Open-VSX, iar o actualizare corectiv\u0103 2.1.314 a fost publicat\u0103.<\/p>\n

Codul pentru desc\u0103rcarea componentelor malware a fost ad\u0103ugat la \u00eenceputul fi\u0219ierului extension.js \u0219i a fost activat \u00een timpul ini\u021bializ\u0103rii extensiei dup\u0103 lansarea VS Code (interac\u021biunea utilizatorului cu Claude nu a fost necesar\u0103 pentru activarea codului mali\u021bios). Activitatea malware-ului consta \u00een crearea unui director ~\/.ssh \u0219i ad\u0103ugarea \u00een fi\u0219ierul ~\/.ssh\/authorized_keys a unei chei publice ssh-ed25519 cu nota\u021bia \u201esvc-telemetrie\u201d. Dup\u0103 aceasta, se efectua o verificare a existen\u021bei procesului de fundal sshd \u00een Linux \u0219i macOS, \u0219i se activa serverul SSH \u00een cazul absen\u021bei acestuia. \u00cen Windows se realiza instalarea OpenSSH prin PowerShell. <\/p>\n

Apoi, codul mali\u021bios salva cheia privat\u0103 \u00eentr-un fi\u0219ier temporar numit \u201e.stk_*\u201d \u0219i configura un tunel invers c\u0103tre un server SSH extern 134.209.82.225 pentru acces de la distan\u021b\u0103, lans\u00e2nd ssh cu op\u021biunile \u201e-N -R \u2018*:0:localhost:22\u2019\u201d. Conexiunea era actualizat\u0103 la fiecare 60 de secunde. Scripturile pentru actualizarea tunelului \u0219i trimiterea de date c\u0103tre externe servere<\/a> erau salvate \u00een fi\u0219ierele ~\/.config\/.smt \u0219i ~\/.config\/.smtk. Rularea periodic\u0103 \u00een Linux era configurat\u0103 prin cron, \u00een macOS prin LaunchAgent (com.apple.sysmond.plist), iar \u00een Windows prin SysMon \u0219i autostart.<\/p>\n

\u00cen plus, \u00een sistem erau colectate informa\u021bii despre numele gazdelor, utilizatorii \u00eenregistra\u021bi, sistemul de operare, directorul personal, email-ul (prin git config \u2014global user.email) \u0219i variabilele de mediu cu nume care con\u021bin cuvintele KEY, TOKEN, SECRET, PASS, AWS \u0219i GCP. Informa\u021biile g\u0103site erau trimise \u00een format JSON la URL http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

Utilizatorii extensiei Claude Code pentru VS Code sunt sf\u0103tui\u021bi s\u0103 verifice sistemele pentru instalarea versiunii mali\u021bioase 2.1.313. Indicatorii de compromitere a sistemului includ apari\u021bia fi\u0219ierelor ~\/.config\/.smt, ~\/.config\/.smtk, ~\/Library\/LaunchAgents\/com.apple.sysmond.plist, ${TMPDIR}\/.stk_*, ~\/.config\/smt.cmd,
\n~\/config\/smtk, SysMon \u0219i sysmon.cmd, precum \u0219i accesarea prin porturile 22 \u0219i 8099 la adresa IP<\/a> 134.209.82.225, \u0219i trimiterea de cereri HTTP\/HTTPS c\u0103tre gazdele ifconfig.me \u0219i api.ipify.org.<\/p>\n

Cum exact au reu\u0219it atacatorii s\u0103 \u00eenlocuiasc\u0103 codul r\u0103u inten\u021bionat \u00een extensie nu este clar, se presupune c\u0103 ar fi putut s\u0103 fi fost compromis un cont de angajat al Anthropic, care se ocup\u0103 cu \u00eentre\u021binerea pachetului, sau a fost folosit\u0103 o problem\u0103 de securitate \u00een sistemul de publicare a lans\u0103rilor.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacatorii au reu\u0219it s\u0103 injecteze cod r\u0103u inten\u021bionat \u00een oficiala extensie Claude Code pentru VS Code | ProHoster","description":"A fost \u00eenregistrat compromiterea oficialei extensii Claude Code pentru VS Code, furnizat\u0103 de compania Anthropic \u0219i av\u00e2nd 63 de milioane de desc\u0103rc\u0103ri.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}