{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"Napada\u010di su uspjeli uvesti zlonamjerni kod u slu\u017ebeni dodatak Claude Code za VS Code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zabele\u017eena je bila kompromitacija uradnega dodatka Claude Code za VS Code, ki ga je izdala podjetje Anthropic in ima 63 milijonov prenosov. Napadalcem je uspelo v katalog Open-VSX postaviti izdajo anthropic.claude-code@2.1.313, ki vsebuje zlonamerno kodo za oddaljen dostop do uporabni\u0161kega sistema. Objavljanje zlonamerne razli\u010dice paketa v Microsoftovem repozitoriju ni potrjeno, vendar je bil zanj prav tako oblikovan poro\u010dilo s opozorilom. Trenutno je problemati\u010dna razli\u010dica odstranjena iz repozitorija Open-VSX, skupaj z objavitvijo popravka razli\u010dice 2.1.314.<\/p>\n

Koda za nalaganje zlonamernih komponent je bil dodan na za\u010detek datoteke extension.js in se je aktiviral ob inicializaciji dodatka po zagonu VS Code (za aktivacijo zlonamerne kode ni bilo potrebno uporabni\u0161ko posredovanje s Claude). Zlonamerna aktivnost je bila omejena na ustvarjanje imenika ~\/.ssh in dodajanje odprtega klju\u010da ssh-ed25519 v datoteko ~\/.ssh\/authorized_keys s pripombo \u201esvc-telemetry\u201c. Po tem se je preverjalo, ali obstaja ozadjski proces sshd v Linuxu in macOS, in aktiviral SSH stre\u017enik v primeru, da ga ni bilo. V Windows se je preko PowerShella namestil OpenSSH. <\/p>\n

Nato je zlonamerna koda shranila zasebni klju\u010d v za\u010dasno datoteko z imenom \u201e.stk_*\u201c in nastavila povratni tunel z zunanjim SSH stre\u017enikom 134.209.82.225 za oddaljen dostop, tako da je zagnala ssh z opcijami \u201e-N -R \u2018*:0:localhost:22\u2019\u201c. Povezava se je obnavljala vsakih 60 sekund. Skripti za posodobitev tunela in po\u0161iljanje podatkov na zunanje servere<\/a> so bili shranjeni v datotekah ~\/.config\/.smt in ~\/.config\/.smtk. Periodi\u010dno zagon v Linuxu je bil nastavljen prek crona, v macOS pa prek LaunchAgent (com.apple.sysmond.plist), medtem ko je bil v Windowsu nastavljen prek SysMon in samodejnega zagona.<\/p>\n

Poleg tega so se v sistemu zbirali podatki o imenu gostitelja, registriranih uporabnikih, operacijskem sistemu, doma\u010demu imeniku, e-po\u0161ti (prek git config \u2014global user.email) in okoljskih spremenljivkah s imeni, ki vsebujejo besede KEY, TOKEN, SECRET, PASS, AWS in GCP. Najdene informacije so bile poslane v formatu JSON na URL http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

Uporabnikom dodatka Claude Code za VS Code se priporo\u010da, da preverijo svoje sisteme glede namestitve zlonamerne razli\u010dice 2.1.313. Indikatorji kompromitacije sistema so pojavitev datotek ~\/.config\/.smt, ~\/.config\/.smtk, ~\/Library\/LaunchAgents\/com.apple.sysmond.plist, ${TMPDIR}\/.stk_*, ~\/.config\/smt.cmd,
\n~\/.config\/smtk, SysMon in sysmon.cmd, prav tako pa dostopanje preko vrat 22 in 8099 do IP adresom<\/a> 134.209.82.225, in po\u0161iljanje HTTP\/HTTPS poizvedb gostiteljem ifconfig.me in api.ipify.org.<\/p>\n

Kako so natan\u010dno hekerji uspeli vstaviti zlonamerno kodo v dodatke, ni \u0161e jasno. Predpostavlja se, da je lahko bila komisijska ra\u010duna zaposlenega pri Anthropic, ki je nadzoroval paket, ali je bila izkori\u0161\u010dena varnostna te\u017eava v sistemu za objavo izdaj.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napadalci so uspeli vstaviti zlonamerno kodo v uradni dodatek Claude Code za VS Code | ProHoster","description":"Zabele\u017eena je bila kompromitacija uradnega dodatka Claude Code za VS Code, ki ga dobavlja podjetje Anthropic in ima 63 milijonov prenosov.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}