Accorian would like to alert you to a critical software supply chain security threat involving a malicious version of the Claude Code extension for Visual Studio Code and compatible IDEs.
On October 30, 2026, security researchers identified a compromised Claude Code extension, version 2.1.313, distributed through the Open VSX registry. The malicious extension contains code designed to install a persistent SSH backdoor, potentially allowing unauthorized remote access to affected developer systems.
Threat Details
- Affected extension: Claude Code (anthropic.claude-code)
- Malicious version: 2.1.313
- Threat type: Software supply chain compromise / SSH backdoor
- Malicious IP address: 134.209.82[.]225
- Associated activity: Reverse SSH connections and system information collection
The malicious code can execute when the extension loads, without requiring further user interaction. It may establish persistent access through unauthorized SSH keys and operating-system startup mechanisms.
Recommended Immediate Actions
We strongly recommend that organizations using Claude Code take the following precautions:
- Verify installed extensions: Ask development teams to check whether Claude Code version 2.1.313 is installed in VS Code, Cursor, or other compatible development environments.
- Investigate affected systems: If the malicious version is identified, immediately isolate the affected endpoint and engage your security team. Do not assume that uninstalling the extension removes the backdoor.
- Review firewall and network logs: Check for historical and active outbound connections to 134.209.82[.]225, particularly on TCP ports 22 and 8099. Block the malicious IP at your network perimeter.
- Check for persistence: Inspect SSH authorized keys, scheduled tasks, cron jobs, and startup mechanisms for unauthorized modifications.
- Assess potential exposure: Review affected developer systems for possible credential exposure, unauthorized access, and suspicious activity involving source code or development environments. Rotate potentially compromised credentials and tokens.
How Accorian Can Help
Accorian’s cybersecurity and offensive security teams can support your organization with threat exposure assessments, endpoint compromise investigations, security validation, and incident response guidance to help identify and contain potential risks.
We recommend treating any system that executed the malicious extension as potentially compromised until it has been thoroughly investigated.
If you require assistance assessing your exposure or validating your security controls, please reach out to your Accorian point of contact.
Stay vigilant,
Accorian Cybersecurity Team
