Trojanized Claude Code Extension Plants SSH Backdoor in Developer Machines

A trojanized Claude Code extension has been discovered planting an SSH backdoor on developer machines, representing one of the first confirmed supply chain attacks targeting AI coding toolchains directly. The malicious extension masquerades as a legitimate Claude Code plugin while silently establishing persistent SSH access, handing attackers a foothold into developer workstations and, by extension, any infrastructure those machines touch.

Why it matters

Claude Code's extension ecosystem has grown fast, and with it the attack surface. Developers routinely install community plugins to add workflow features, as illustrated by the same week's orc-voice notification plugin appearing on HN. Most teams apply far less scrutiny to an AI coding plugin than to a production npm dependency. That gap is exactly what this attack exploits.

An SSH backdoor is not a nuisance payload. It grants interactive shell access, enabling lateral movement, secret exfiltration, and persistent re-entry even after the extension is removed, as long as the authorized key remains in ~/.ssh/authorized_keys.

AI tooling extensions are the new browser extensions: everyone installs them, almost no one audits them.

For teams shipping LLM-powered agents, the blast radius is especially wide. Agent processes often run with broad filesystem and network permissions. A compromised developer machine is one hop from a compromised agent runtime.

What changes in practice

• Extension installs are now a security event. Treat any Claude Code plugin with the same review process as a new open-source library entering your codebase.
• SSH authorized_keys files need auditing. The backdoor persists after uninstall if the key is not removed manually.
• CI/CD pipelines are in scope. If developers run Claude Code on machines with repo write access or cloud credentials, the attacker inherits those permissions.
• The extension marketplace trust model is broken by default. There is no code-signing or sandboxing guarantee equivalent to, say, Chrome's extension review for most AI tool plugin ecosystems today.

How to use it

1. Audit installed extensions immediately. Run claude ext list (or equivalent) across your team's machines and cross-reference against a known-good allowlist.
2. Check ~/.ssh/authorized_keys on every affected machine for unfamiliar public keys and remove them. Rotate any secrets stored on those machines.
3. Lock down extension sources. Allow only extensions from your organization's internal registry or from sources you have reviewed at the source-code level.
4. Add extension installs to your security runbook. Require a lightweight review (read the source, check network calls) before any new plugin goes into team use.
5. Monitor outbound SSH from developer machines. Unexpected outbound port-22 connections are a strong indicator of backdoor activity.

Check the Security tag for related coverage on AI tooling vulnerabilities.

The safest Claude Code extension is one you read before you run it.