Executive Summary
A malicious version of the legitimate `anthropic.claude-code` VS Code extension (v2.1.313) was identified on the Open-VSX registry. The extension contains a 66-line malicious JavaScript loader prepended to the legitimate code, which executes immediately upon extension activation. This implant targets developers across macOS, Linux, and Windows platforms to establish persistent remote access.
The attack chain involves creating an unauthorized SSH key labeled `svc-telemetry`, attempting to enable local SSH services, and establishing a reverse SSH tunnel to the C2 server at `134.209.82[.]225`. It also collects sensitive host information, including environment variable names associated with cloud providers and credentials, and transmits them via unencrypted HTTP beacons.
This threat is critical for development teams as it bypasses standard security controls by weaponizing a trusted IDE tool. While the compromise was confirmed on Open-VSX, the nature of the breach suggests potential risk to other distribution channels. Immediate identification and remediation of affected developer workstations are required to prevent follow-on lateral movement or data exfiltration.