Executive Summary
On 30 October 2026 OpenSourceMalware published an analysis of an editor extension that presents itself as anthropic.claude-code version 2.1.313 and carries a backdoor. The analyzed copy came from Open VSX. A loader of about 66 lines runs before the legitimate code when the extension loads and needs no user interaction. It collects host details and the names (not the values) of environment variables that contain words such as KEY, TOKEN, AWS or GCP.
The loader turns on the local SSH service, adds an Ed25519 key labeled svc-telemetry to authorized_keys and opens a reverse SSH tunnel to 134[.]209[.]82[.]225. Persistence uses a LaunchAgent on macOS, an @reboot crontab entry on Linux and a scheduled task on Windows. The post found no second stage download.
The analyzed sample targets darwin-arm64 (macOS on Apple Silicon). The post does not say whether Windows or Linux builds were distributed. It does not show that Anthropic's own release process was compromised and it does not identify the attacker or the distribution source. The risk is for developers who install extensions from third party registries.