Anthropic’s Claude Code ecosystem is under siege from a sophisticated data exfiltration campaign, and the community is responding with specialized forensic tools. The open-source project check-claude-code-exfil provides a read-only indicator-of-compromise (IOC) scanner designed specifically to detect the compromise documented in claude-code-vx-compromise.html. Built in Go with CGO_ENABLED=0, the tool produces standalone binaries for macOS, Linux, and Windows, ensuring it can be deployed across heterogeneous development environments without dependency hell.

Technical Scope and Detection Vectors

The scanner targets specific artifacts associated with version 2.1.313 of the anthropic.claude-code VS Code extension. It verifies the SHA-256 hash of the extension.js file against the documented bundle hash ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. Beyond the extension itself, the tool hunts for SSH backdoor keys, including victim-login public keys and tunnel private keys associated with the attacker infrastructure at IP 134.209.82.225. It also inspects persistence mechanisms such as macOS LaunchAgents (com.apple.sysmond.plist), Linux crontabs, and Windows Scheduled Tasks named SysMon.

Live Process and Network Inspection

Unlike static file scanners, this tool actively inspects running processes and network connections. It flags processes referencing specific malware artifacts like .stk_, svc-telemetry, or reverse-forward patterns (*:0:localhost:22). Network inspection identifies TCP connections to 134.209.82.225 or local beacons on port 8099. The implementation varies by OS: Linux reads /proc/net/tcp, macOS uses lsof, and Windows relies on netstat -ano. Crucially, the scanner makes no outbound network connections itself, preserving forensic integrity.

Key Takeaways

  • The scanner is detection-only; it does not remediate, delete files, or kill processes.
  • Elevated privileges (root/admin) are required for a complete scan of all user homes and processes.
  • Legitimate use of ifconfig.me and api.ipify.org is explicitly not flagged as an IOC to reduce false positives.
  • The tool checks a wide range of IDEs, including VS Code, Cursor, Windsurf, and VSCodium.

The Bottom Line

This is a necessary band-aid for a bleeding wound. If you are running Claude Code version 2.1.313, assume you are compromised until this tool proves otherwise. The lack of remediation features means security teams must still handle the cleanup manually, but the precise IOC mapping saves hours of forensic digging.