Security· ★★★· bearish·

Claude Code VS Code extension compromised with SSH backdoor in version 2.1.313

  • —Malicious anthropic.claude-code@2.1.313 was published to Open VSX
  • —The loader in extension.js triggers on VS Code startup and Webview open
  • —It adds an svc-telemetry SSH key and a reverse tunnel to 134.209.82.225:8099
  • —Persistence is set on macOS, Linux and Windows; recon data is sent over HTTP
Why it matters: The supply-chain attack hit a developer tool whose users often hold SSH keys to servers and wallets.
Source: ChainCatcher 链捕手
More on this
Security · Oct 23
SlowMist flags fake Solidity GitHub repo hiding wallet-stealing backdoor
 Security · Oct 19
Backdoors found in Ledger wallets sold by authorized resellers in Europe
 Security · Oct 24
Bitcoin Core speeds up security fixes as 44% of surveyed nodes run unsupported versions