Check for IOCs for the ongoing Claude Code extensions exfil campaign

Security researcher cookiengineer published a dedicated open-source detection utility designed to identify compromised developer environments linked to the Claude Code extension supply-chain incident, as detailed in github.com's report. The utility, titled check-claude-code-exfil, operates as a strictly read-only indicator-of-compromise scanner targeting unauthorized modifications across macOS, Linux, and Windows developer environments. It compiles with CGO_ENABLED=0 into self-contained standalone binaries that execute without third-party Go dependencies, ensuring engineers can audit suspect workstations without modifying local disk artifacts or executing unwanted external network requests.

This technical breakdown examines the operational scope of the scanner, the exact cryptographic indicators it matches, and the evaluation criteria security teams require to audit their engineering fleet. The utility serves systems engineers, DevSecOps teams, and software developers running modern coding workstations across editors including VS Code, Cursor, Windsurf, VSCodium, Positron, Trae, and Kiro. By systematically inspecting local extension caches, authorized SSH keys, background persistence mechanisms, running processes, and active network sockets, the project provides a comprehensive verification tool to determine whether developer machines were exposed to the backdoored extension campaign.

What shipped in Check for IOCs for the ongoing Claude Code

The scanner releases standalone compiled binaries that inspect the entire lifecycle of the extension compromise without interacting with malicious infrastructure. When deployed, the software scans host directories for the vulnerable anthropic.claude-code extension release at version 2.1.313 across platform-specific installation roots such as anthropic.claude-code-2.1.313-win32-x64. It validates manifest package.json files and computes a SHA-256 cryptographic digest of extension.js bundles, evaluating against the documented malicious bundle hash ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 across known editor trees and user-defined home directories.

Beyond static files, the release integrates inspection routines across authorized SSH keys, persistence mechanisms, and live system state. The tool inspects authorized_keys files for the compromised victim-login fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and flags the svc-telemetry comment string. It also parses unencrypted OpenSSH tunnel private keys in temporary folders and user profiles, validating against the documented tunnel-key fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ, while isolating background process execution matching attacker infrastructure at IP address 134.209.82.225.

What improved in Check for IOCs for the ongoing Claude Code

Scanning capabilities improve significantly upon manual forensic checks by automating cross-platform validation of persistence entries, active process command lines, and network socket connections. The scanner inspects OS-specific scheduler mechanisms including macOS LaunchAgents at ~/Library/LaunchAgents/com.apple.sysmond.plist, user crontabs across Linux and macOS spool paths, Windows scheduled tasks via schtasks queries for SysMon, and Windows Startup folder scripts named sysmon.cmd. Rather than relying on simple file name checks, the utility analyzes file contents directly to detect backdoor references like .config/.smt, .smtk, smtk, and smt.cmd.

The inspection engine also introduces structured runtime telemetry validation to monitor active evasion tactics across processes and TCP network sockets. On Linux, the utility evaluates process arguments via /proc/pid/cmdline and matches socket inodes directly through /proc/net/tcp and /proc/pid/fd mappings, while macOS leverages lsof with netstat fallbacks and Windows queries Win32_Process through PowerShell. To preserve diagnostic precision, legitimate discovery traffic to external IP lookup providers such as ifconfig.me and api.ipify.org is deliberately excluded from generating standalone alerts.

What you gain from Check for IOCs for the ongoing Claude Code

Deploying check-claude-code-exfil gives engineering organizations a non-destructive audit mechanism that preserves live system state for deeper forensic handling. Because the utility never attempts automatic remediation, deletes files, or kills running processes, forensic teams can run scans across critical development workstations without corrupting evidential trails. The design guarantees that private key contents are never exposed in terminal stdout or written into log files, displaying only parsed paths, derived OpenSSH public-key fingerprints, and matched tokens.

Furthermore, teams operating across heterogeneous developer workstations gain automated multi-profile coverage under elevated execution. Running the binary as root on Linux and macOS automatically scans all local user home roots, including macOS per-user temporary folders under /var/folders alongside /tmp, /var/tmp, and /private/tmp. The scanner issues clear return codes, using exit code 0 for clean environments, 1 when malicious indicators are detected, and 2 when permission issues or missing system inspection utilities cause incomplete runs, preventing operators from confusing permission errors with clean systems.

How to get Check for IOCs for the ongoing Claude Code

Teams can compile the tool directly from source using the Go toolchain and standard Make commands. The repository provides targets to produce standalone binaries across all primary platforms, including Linux, macOS, and Windows on both x86-64 and ARM64 architectures.

make build

To build a specific binary directly using the Go compiler without Make, developers can disable cgo and specify their target architecture:

cd source
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ../build/check-claude-code-exfil_linux_amd64 ./cmds/check-claude-code-exfil

To execute the compiled scanner across common operating system configurations, run the corresponding binary with administrative elevation:

```bash
# Linux
sudo ./build/check-claude-code-exfil_linux_amd64

Windows (from an elevated terminal)

Advanced scan configurations allow security administrators to target mounted forensic disks, generate automated machine-readable output for SIEM pipelines, or omit specific dynamic subsystems:

./build/check-claude-code-exfil_linux_amd64 --home /mnt/forensics/user --json --verbose

What to watch after Check for IOCs for the ongoing Claude Code

Security administrators executing the utility must account for several operational limits and manual verification steps following a scan. Because the scanner performs detection exclusively, any positive discovery requires explicit incident response intervention to revoke exposed credentials, remove unauthorized keys, terminate active tunnel sessions, and scrub scheduled persistence artifacts. A positive match against the loopback socket at 127.0.0.1:8099 represents a warning indicator that warrants manual verification, as unrelated local engineering services could legitimately bind to that port.

Additionally, organizations must ensure scans run with full administrative rights to prevent blind spots across local user directories and system processes. If non-standard IDE installation roots are maintained outside the default ~/.ide/extensions path, operators must supply those custom directories manually using the repeatable --home flag. Administrators auditing Windows environments should also confirm that PowerShell, schtasks, and netstat utilities remain functional on target systems, as any restriction preventing their execution causes the tool to register an exit code 2 incomplete audit.