Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
19 Boosts
2 Likes
@briankrebs @GossiTheDog
Ah, lovely. Very important thing that is affecting a company's reputation, with customers afraid. What do we do? Have a rando user post a statement on Hacker News.
@briankrebs @GossiTheDog I don't think you even need to be a hardened partisan in the semantic versioning wars to be alarmed at the idea of using a delta of 0.0.001 to 'disambiguate' the malicious package that somehow ended up in a trusted location from the trusted package with the identical name.
I'd imagine it updated from a previous version rather than the Binance engineer just suddenly downloading it, so it's most likely at least a breach of their signing key, no?
@GossiTheDog here's a detection #osquery for #macos, in case it helps anyone
https://gist.github.com/RichardoC/9753dfa5aeffc6a1201f5e57114f54ff
This federated comment is not yet available here.
C2 server collected for each victim endpoint:
- hostname
- username
- OS
- architecture
- home directory path
- environment variable names
- working directories
- configured Git email
It then ran a reverse SSH connection allowing the threat actor to pick and chose which victims to have hands on keyboard access to.
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
I've confirmed Binance use Claude Code with this extension.
@GossiTheDog@cyberplace.social This whole thing makes me SO confused? What even is Open VSX and what actually uses that for extensions? I would assume VS Code only uses official marketplace?
Then I took a look at the Open VSX registry and the Claude Code for VS Code is just uploaded by some random entity called igorkofman?
EDIT: Does vscodium use Open VSX?
EDIT 2: Why does Open VSX have 63M downloads while official marketplace has 29M downloads???
EDIT 3: I read the article again
Open VSX serves extensions to VS Code-compatible editors like Cursor and Windsurf.
aaaaa lmao that also explains the amount of downloads being different. Fair to assume that literal AI editors has more downloads for Claude Code than just vscode/vscodium
2 media files
@jalict Yeah Open VSX was predominantly used by vscodium and I guess Eclipse as it's an Eclipse Foundation project. I'd published my open-source VS Code extension there for the 5 people on vscodium. I never considered that Cursor also grabs its extensions from Open VSX. Wild to see an Open VSX extension with 60 million downloads.
@chris@nutmeg.social I think that’s what makes this story both more insane AND confusion. Had no clue that the market of vscode forks (put simple) extensions usage is LARGER than your ordinary programmers vscode
That extension has 29 million installs, one of the most popular extensions in DevOps. It creates a reverse SSH backdoor.
@GossiTheDog with a logo like that, are people really surprised about a backdoor?
Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.
The plugin auto updates so every org will have been impacted.
To be clear this is a supply chain attack, the threat actor got reverse SSH (command line) connectivity to Anthropic customer environments at scale.
FWIW the compromised version, 2.1.313, was removed from OpenVSX. 2.1.314 is the ‘fixed’ version.
2 media files
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
https://news.ycombinator.com/item?id=50300683