Threat Advisory – Trojanized Claude Code Extension: SSH Backdoor

Publisher preview

A tampered build of the Claude Code editor extension (anthropic.claude-code 2.1.313) was published on the Open VSX store used by Vs code,Cursor and similar editors, quietly gives attackers persistent remote access to any computer that runs it, while the extension keeps working normally. Researchers don’t yet know how it was published (the listing belongs to an Anthropic employee) or who is behind it. They found no evidence that Anthropic’s official Marketplace release was affected. Snowbit-observed: Users received it through Vscode/Cursor’s automatic updates on 29 October, before it was made public. Treat any machine that loaded 2.1.313 as compromised: isolate it, block 134.209.82[.]225, and rotate the user’s credentials from a clean device. - Runtime execution: No install or postinstall scripts. The loader runs before the legitimate bundle on editor start or when the webview opens, and suppresses its own errors so the extension keeps working. - Recon: Collects hostname, user, OS/arch, home and working directory, git config –global user.email, the names (not values) of up to 40 environment variables matching KEY/TOKEN/SECRET/PASS/AWS/GCP, and the public IP via curl to ifconfig[.]me and api.ipify[.]org.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.