coding-agent-audit 0.1.0__tar.gz → 0.2.0__tar.gz

{coding_agent_audit-0.1.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.1.0
+Version: 0.2.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -38,11 +38,13 @@ A small, open-source CLI that scans your machine for:
 ## Why this exists
 
 In October 2026, a trojanized build of the Claude Code extension
-(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
-silently added an SSH key, enabled remote login, opened a reverse SSH
-tunnel to an attacker-controlled server, and installed persistence
-disguised as a system daemon — no user interaction required beyond the
-editor loading the extension.
+(`anthropic.claude-code@2.1.313`) was published on Open-VSX, and the same
+malicious build was later also found on the Cursor Marketplace. Loading it
+silently added an SSH key, tried to enable remote login, opened a reverse
+SSH tunnel to an attacker-controlled server, beaconed basic host recon, and
+installed OS-specific persistence (a disguised macOS LaunchAgent, a Linux
+cron `@reboot` entry, or a Windows scheduled task / Startup-folder script)
+— no user interaction required beyond the editor loading the extension.
 
 This tool is an **independent re-implementation**, from scratch, of the
 publicly documented indicators from that incident (file paths, a known
@@ -82,17 +84,19 @@ one critical (confirmed-IOC-pattern) finding.
 
 ### What it checks
 
-**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
-Code trojan:
+**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX /
+Cursor Marketplace Claude Code trojan:
 
 - `~/.ssh/authorized_keys` for the planted key comment
 - `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
-- Marker files under `~/.config`
+- Marker files under `~/.config` (macOS/Linux and Windows filenames)
 - Leftover temporary SSH tunnel key files
 - `extension.js` files under common VS Code / Cursor / Windsurf extension
   directories, hash-compared against the known-malicious build
 - Running processes / crontab for references to the known C2 host or
   persistence task name
+- On Windows: the known SYSTEM scheduled task name, and the Startup-folder
+  script dropped as a fallback when that task can't be created
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -127,6 +131,15 @@ pytest
 
 - doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
+- Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
+
+## Support
+
+This tool is free and MIT-licensed, no strings attached. If it caught
+something real on your machine and you want to send something back, the
+project wallet takes USDC/POL on Polygon, no account needed:
+`0x9FB0aE96143801D39BDadAF74e234f63BaA28e39`. Entirely optional - installing
+and running the scan asks nothing of you.
 
 ## License
 

{coding_agent_audit-0.1.0 → coding_agent_audit-0.2.0}/README.md

@@ -18,11 +18,13 @@ A small, open-source CLI that scans your machine for:
 ## Why this exists
 
 In October 2026, a trojanized build of the Claude Code extension
-(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
-silently added an SSH key, enabled remote login, opened a reverse SSH
-tunnel to an attacker-controlled server, and installed persistence
-disguised as a system daemon — no user interaction required beyond the
-editor loading the extension.
+(`anthropic.claude-code@2.1.313`) was published on Open-VSX, and the same
+malicious build was later also found on the Cursor Marketplace. Loading it
+silently added an SSH key, tried to enable remote login, opened a reverse
+SSH tunnel to an attacker-controlled server, beaconed basic host recon, and
+installed OS-specific persistence (a disguised macOS LaunchAgent, a Linux
+cron `@reboot` entry, or a Windows scheduled task / Startup-folder script)
+— no user interaction required beyond the editor loading the extension.
 
 This tool is an **independent re-implementation**, from scratch, of the
 publicly documented indicators from that incident (file paths, a known
@@ -62,17 +64,19 @@ one critical (confirmed-IOC-pattern) finding.
 
 ### What it checks
 
-**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
-Code trojan:
+**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX /
+Cursor Marketplace Claude Code trojan:
 
 - `~/.ssh/authorized_keys` for the planted key comment
 - `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
-- Marker files under `~/.config`
+- Marker files under `~/.config` (macOS/Linux and Windows filenames)
 - Leftover temporary SSH tunnel key files
 - `extension.js` files under common VS Code / Cursor / Windsurf extension
   directories, hash-compared against the known-malicious build
 - Running processes / crontab for references to the known C2 host or
   persistence task name
+- On Windows: the known SYSTEM scheduled task name, and the Startup-folder
+  script dropped as a fallback when that task can't be created
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -107,6 +111,15 @@ pytest
 
 - doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
+- Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
+
+## Support
+
+This tool is free and MIT-licensed, no strings attached. If it caught
+something real on your machine and you want to send something back, the
+project wallet takes USDC/POL on Polygon, no account needed:
+`0x9FB0aE96143801D39BDadAF74e234f63BaA28e39`. Entirely optional - installing
+and running the scan asks nothing of you.
 
 ## License
 

{coding_agent_audit-0.1.0 → coding_agent_audit-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.1.0"
+version = "0.2.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.1.0 → coding_agent_audit-0.2.0}/src/agentaudit/checks.py

@@ -202,6 +202,66 @@ def check_linux_cron_persistence(crontab_text: str) -> list[Finding]:
     return []
 
 
+def check_windows_scheduled_task(schtasks_output: str) -> list[Finding]:
+    """Flag a `schtasks /query` output that reports the known SYSTEM
+    persistence task."""
+    task_name = _IOC["windows_task_name"]
+    if task_name in schtasks_output and "ERROR" not in schtasks_output.upper():
+        return [
+            Finding(
+                check_id="windows-scheduled-task",
+                severity="critical",
+                title="Known backdoor scheduled task found",
+                detail=(
+                    f"A scheduled task named '{task_name}' exists, matching "
+                    f"the SYSTEM-level persistence task created by the "
+                    f"{_IOC['name']}."
+                ),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def check_windows_startup_folder(appdata: Path) -> list[Finding]:
+    """Flag the Startup-folder fallback script used on Windows when the
+    SYSTEM scheduled task cannot be created (non-admin user)."""
+    path = appdata / _IOC["windows_startup_relpath"]
+    if path.exists():
+        return [
+            Finding(
+                check_id="windows-startup-folder",
+                severity="critical",
+                title="Known backdoor Startup-folder script found",
+                detail=(
+                    f"'{path}' exists and matches the Startup-folder "
+                    f"fallback script dropped by the {_IOC['name']} when it "
+                    f"can't create a SYSTEM scheduled task."
+                ),
+                path=str(path),
+                references=_IOC["references"],
+            )
+        ]
+    return []
+
+
+def live_windows_scheduled_task_text() -> str:
+    """Best-effort `schtasks /query` for the known task name; empty string
+    if unavailable (not Windows, task not found, etc.)."""
+    try:
+        result = subprocess.run(
+            ["schtasks", "/query", "/tn", _IOC["windows_task_name"], "/fo", "list"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    if result.returncode != 0:
+        return ""
+    return result.stdout
+
+
 def live_crontab_text() -> str:
     """Best-effort read of the current user's crontab; empty string if
     unavailable (no cron, not installed, permission denied, etc.)."""
@@ -244,4 +304,8 @@ def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
     findings += check_linux_cron_persistence(live_crontab_text())
     if platform.system() == "Darwin":
         findings += check_macos_launch_agent(home)
+    if platform.system() == "Windows":
+        appdata = Path(os.environ.get("APPDATA", home / "AppData" / "Roaming"))
+        findings += check_windows_startup_folder(appdata)
+        findings += check_windows_scheduled_task(live_windows_scheduled_task_text())
     return findings

{coding_agent_audit-0.1.0 → coding_agent_audit-0.2.0}/src/agentaudit/iocs.py

@@ -16,17 +16,20 @@ from __future__ import annotations
 
 INCIDENTS = {
     "openvsx-claude-code-2026-10": {
-        "name": "Trojanized Claude Code extension on Open-VSX (Oct 2026)",
+        "name": "Trojanized Claude Code extension on Open-VSX / Cursor Marketplace (Oct 2026)",
         "description": (
-            "anthropic.claude-code@2.1.313 published on Open-VSX had a "
-            "66-line malicious loader prepended to extension.js. It added "
-            "an SSH key, enabled remote login, opened a reverse SSH tunnel "
-            "to a C2 server, and installed persistence disguised as a "
-            "system daemon."
+            "anthropic.claude-code@2.1.313, distributed via both Open-VSX "
+            "and the Cursor Marketplace, had a malicious loader prepended "
+            "to extension.js. It added an SSH key, tried to enable remote "
+            "login, opened a reverse SSH tunnel to a C2 server, beaconed "
+            "basic host recon, and installed OS-specific persistence "
+            "(macOS LaunchAgent, Linux cron @reboot entry, Windows "
+            "scheduled task / Startup-folder script)."
         ),
         "references": [
             "https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2",
             "https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj",
+            "https://phorion.io/blog/offical-claude-code-vsx-compromise/",
         ],
         # SSH public key comment appended to ~/.ssh/authorized_keys
         "ssh_key_comment": "svc-telemetry",
@@ -38,9 +41,14 @@ INCIDENTS = {
         "c2_ports": [22, 8099],
         # Marker / persistence file names observed on infected hosts
         "macos_launch_agent": "com.apple.sysmond.plist",
-        "marker_filenames": [".smt", ".smtk", "smt.cmd"],
+        "marker_filenames": [".smt", ".smtk", "smt.cmd", "smtk"],
         "tmp_tunnel_glob": ".stk_*",
         "linux_cron_marker": "SysMon",
         "windows_task_name": "SysMon",
+        # Startup-folder fallback used on Windows when creating the SYSTEM
+        # scheduled task fails (relative to %APPDATA%)
+        "windows_startup_relpath": (
+            "Microsoft/Windows/Start Menu/Programs/Startup/sysmon.cmd"
+        ),
     }
 }

{coding_agent_audit-0.1.0 → coding_agent_audit-0.2.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.1.0
+Version: 0.2.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -38,11 +38,13 @@ A small, open-source CLI that scans your machine for:
 ## Why this exists
 
 In October 2026, a trojanized build of the Claude Code extension
-(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
-silently added an SSH key, enabled remote login, opened a reverse SSH
-tunnel to an attacker-controlled server, and installed persistence
-disguised as a system daemon — no user interaction required beyond the
-editor loading the extension.
+(`anthropic.claude-code@2.1.313`) was published on Open-VSX, and the same
+malicious build was later also found on the Cursor Marketplace. Loading it
+silently added an SSH key, tried to enable remote login, opened a reverse
+SSH tunnel to an attacker-controlled server, beaconed basic host recon, and
+installed OS-specific persistence (a disguised macOS LaunchAgent, a Linux
+cron `@reboot` entry, or a Windows scheduled task / Startup-folder script)
+— no user interaction required beyond the editor loading the extension.
 
 This tool is an **independent re-implementation**, from scratch, of the
 publicly documented indicators from that incident (file paths, a known
@@ -82,17 +84,19 @@ one critical (confirmed-IOC-pattern) finding.
 
 ### What it checks
 
-**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
-Code trojan:
+**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX /
+Cursor Marketplace Claude Code trojan:
 
 - `~/.ssh/authorized_keys` for the planted key comment
 - `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
-- Marker files under `~/.config`
+- Marker files under `~/.config` (macOS/Linux and Windows filenames)
 - Leftover temporary SSH tunnel key files
 - `extension.js` files under common VS Code / Cursor / Windsurf extension
   directories, hash-compared against the known-malicious build
 - Running processes / crontab for references to the known C2 host or
   persistence task name
+- On Windows: the known SYSTEM scheduled task name, and the Startup-folder
+  script dropped as a fallback when that task can't be created
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -127,6 +131,15 @@ pytest
 
 - doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
+- Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
+
+## Support
+
+This tool is free and MIT-licensed, no strings attached. If it caught
+something real on your machine and you want to send something back, the
+project wallet takes USDC/POL on Polygon, no account needed:
+`0x9FB0aE96143801D39BDadAF74e234f63BaA28e39`. Entirely optional - installing
+and running the scan asks nothing of you.
 
 ## License
 

{coding_agent_audit-0.1.0 → coding_agent_audit-0.2.0}/tests/test_checks.py

@@ -9,6 +9,8 @@ from agentaudit.checks import (
     check_marker_files,
     check_ssh_authorized_keys,
     check_tmp_tunnel_keys,
+    check_windows_scheduled_task,
+    check_windows_startup_folder,
     default_extension_scan_dirs,
 )
 from agentaudit.iocs import INCIDENTS
@@ -153,3 +155,43 @@ def test_cron_persistence_marker_without_reboot():
     marker = _IOC["linux_cron_marker"]
     text = f"0 3 * * * /usr/local/bin/{marker} --daemon\n"
     assert check_linux_cron_persistence(text) == []
+
+
+def test_windows_scheduled_task_clean():
+    output = (
+        "ERROR: The system cannot find the file specified.\n"
+    )
+    assert check_windows_scheduled_task(output) == []
+
+
+def test_windows_scheduled_task_found():
+    task_name = _IOC["windows_task_name"]
+    output = f"TaskName: \\{task_name}\nStatus: Ready\n"
+    findings = check_windows_scheduled_task(output)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "windows-scheduled-task"
+
+
+def test_windows_startup_folder_absent(tmp_path: Path):
+    assert check_windows_startup_folder(tmp_path) == []
+
+
+def test_windows_startup_folder_present(tmp_path: Path):
+    relpath = _IOC["windows_startup_relpath"]
+    target = tmp_path / relpath
+    target.parent.mkdir(parents=True)
+    target.write_text("@echo off\n")
+    findings = check_windows_startup_folder(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "windows-startup-folder"
+
+
+def test_marker_files_includes_windows_variant(tmp_path: Path):
+    config_dir = tmp_path / ".config"
+    config_dir.mkdir()
+    assert "smtk" in _IOC["marker_filenames"]
+    (config_dir / "smtk").write_text("x")
+    findings = check_marker_files(tmp_path)
+    assert len(findings) == 1