{"id":184040,"date":"2026-10-30T11:41:56","date_gmt":"2026-10-30T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-smogli-vnedrit-vredonosnyj-kod-v-oficzialnoe-dopolnenie-claude-code-k-vs-code"},"modified":"2026-10-30T11:41:59","modified_gmt":"2026-10-30T09:41:59","slug":"attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","title":{"rendered":"Angriparna lyckades inf\u00f6ra skadlig kod i det officiella till\u00e4gget Claude Code till VS Code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En kompromettering av det officiella till\u00e4gget Claude Code f\u00f6r VS Code, som tillhandah\u00e5lls av Anthropic och har 63 miljoner nedladdningar, har registrerats. Angripare lyckades placera utg\u00e5van anthropic.claude-code@2.1.313 i Open-VSX-katalogen, som inneh\u00f6ll skadlig kod f\u00f6r att f\u00e5 fj\u00e4rr\u00e5tkomst till anv\u00e4ndarens system. Publiceringen av den skadliga versionen av paketet i Microsofts repository har inte bekr\u00e4ftats, men en rapport har \u00e4ven viss utf\u00e4rdats f\u00f6r den. Just nu har den problematiska versionen tagits bort fr\u00e5n Open-VSX-repo och en korrigerande version 2.1.314 har publicerats.<\/p>\n

Koden f\u00f6r att ladda ner skadliga komponenter lades till i b\u00f6rjan av filen extension.js och aktiverades vid initiering av till\u00e4gget efter att VS Code startades (f\u00f6r aktivering av skadlig kod kr\u00e4vdes ingen anv\u00e4ndarinteraktion med Claude). Den skadliga aktiviteten bestod av att skapa en katalog ~\/.ssh och l\u00e4gga till en \u00f6ppen ssh-ed25519 nyckel i filen ~\/.ssh\/authorized_keys med anteckningen \u00absvc-telemetry\u00bb. Efter detta kontrollerades n\u00e4rvaron av den bakgrundsprocessen sshd i Linux och macOS, och SSH-servern aktiverades om den saknades. I Windows installerades OpenSSH via PowerShell. <\/p>\n

D\u00e4refter sparade den skadliga koden den privata nyckeln i en tempor\u00e4r fil med namnet \u00ab.stk_*\u00bb och konfigurerade en omv\u00e4nd tunnel med den externa SSH-servern 134.209.82.225 f\u00f6r fj\u00e4rr\u00e5tkomst, genom att k\u00f6ra ssh med alternativen \u00ab-N -R '*:0:localhost:22'\u00bb. Anslutningen uppdaterades var 60:e sekund. Skripter f\u00f6r att uppdatera tunneln och skicka data till externa servrar<\/a> samlades in i filerna ~\/.config\/.smt och ~\/.config\/.smtk. Periodisk k\u00f6rning i Linux konfigurerades genom cron, i macOS genom LaunchAgent (com.apple.sysmond.plist), och i Windows genom SysMon och autostart.<\/p>\n

Ut\u00f6ver detta samlades information i systemet om v\u00e4rdnamn, registrerade anv\u00e4ndare, operativsystem, hemkatalog, e-post (genom git config \u2014global user.email) och milj\u00f6variabler med namn som inneh\u00f6ll orden KEY, TOKEN, SECRET, PASS, AWS och GCP. De funna uppgifterna skickades i JSON-format till URL http:\/\/134.209.82.225:8099\/beacon.<\/p>\n

Anv\u00e4ndare av till\u00e4gget Claude Code f\u00f6r VS Code rekommenderas att kontrollera sina system f\u00f6r installation av den skadliga versionen 2.1.313. Indikatorer p\u00e5 systemkompromittering inkluderar att filer med namnen ~\/.config\/.smt, ~\/.config\/.smtk, ~\/.Library\/LaunchAgents\/com.apple.sysmond.plist, ${TMPDIR}\/.stk_*, ~\/.config\/smt.cmd,
\n~\/.config\/smtk, SysMon och sysmon.cmd, samt anslutningar till portar 22 och 8099. IP-adress<\/a> 134.209.82.225, och skickar HTTP\/HTTPS-f\u00f6rfr\u00e5gningar till v\u00e4rdarna ifconfig.me och api.ipify.org.<\/p>\n

Hur angriparna lyckades injicera skadlig kod i till\u00e4gget \u00e4r fortfarande oklart, men det antas att en anst\u00e4lld p\u00e5 Anthropic som hanterade paketet kan ha f\u00e5tt sitt konto hackat, eller att en s\u00e5rbarhet i publiceringssystemet kan ha utnyttjats.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Open-VSX \u0440\u0435\u043b\u0438\u0437 anthropic.claude-code@2.1.313, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Microsoft \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430, \u043d\u043e \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0442\u043e\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u043e\u0442\u0447\u0451\u0442 c \u0441 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435\u043c. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Angriparna lyckades injicera skadlig kod i det officiella till\u00e4gget Claude Code f\u00f6r VS Code | ProHoster","description":"Kompromiss av det officiella till\u00e4gget Claude Code f\u00f6r VS Code, tillhandah\u00e5llet av Anthropic och med 63 miljoner nedladdningar, har dokumenterats.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 Claude Code \u043a VS Code | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Claude Code \u0434\u043b\u044f VS Code, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Anthropic \u0438 \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 63 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/attackers-injected-malicious-code-into-the-official-claude-code-extension-for-vs-code","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-30T09:41:56+00:00","article:modified_time":"2026-10-30T09:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/184040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=184040"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/184040\/revisions"}],"predecessor-version":[{"id":184041,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/184040\/revisions\/184041"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=184040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=184040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=184040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}