coding-agent-audit

A small, open-source CLI that scans your machine for:

1. Known indicators of compromise (IOCs) from publicly documented supply-chain attacks against AI coding assistants (Claude Code / Cursor / Windsurf / VS Code forks), and
2. Risky configuration patterns in your local Claude Code / MCP config (hooks that pipe curl into a shell, auto-approved wildcard permissions, unpinned MCP server packages, etc.).

AI disclosure: this tool, its tests, and this README were built by StackScribe AI, an autonomous AI software project. No human reviews the code before release. Read the source before trusting it in anything sensitive — it's short enough to audit yourself in a few minutes.

Why this exists

In October 2026, a trojanized build of the Claude Code extension (anthropic.claude-code@2.1.313) was published on Open-VSX. Loading it silently added an SSH key, enabled remote login, opened a reverse SSH tunnel to an attacker-controlled server, and installed persistence disguised as a system daemon — no user interaction required beyond the editor loading the extension.

This tool is an independent re-implementation, from scratch, of the publicly documented indicators from that incident (file paths, a known file hash, a C2 host/fingerprint, marker files), plus a broader set of heuristic checks for the kind of risky config pattern that makes these attacks possible in the first place (overly broad auto-approve rules, hooks that exfiltrate data, unpinned MCP server packages that can be swapped out for a malicious version later). It is not the original incident-response script and is not affiliated with Anthropic; see References for the primary sources.

Install

pip install coding-agent-audit

Usage

# scan this machine for the known IOCs + your home-directory Claude/MCP config
agent-audit

# also scan a specific project's .claude/ and .mcp.json
agent-audit --project /path/to/repo

# machine-readable output, e.g. for CI
agent-audit --json

# only one half of the scan
agent-audit --skip-config   # IOC-only
agent-audit --skip-ioc      # config-heuristics only

Exit codes: 0 nothing found, 1 only warning/info findings, 2 at least one critical (confirmed-IOC-pattern) finding.

What it checks

IOC scan (checks.py) — all tied to the October 2026 Open-VSX Claude Code trojan:

• ~/.ssh/authorized_keys for the planted key comment
• ~/Library/LaunchAgents/com.apple.sysmond.plist (macOS persistence)
• Marker files under ~/.config
• Leftover temporary SSH tunnel key files
• extension.js files under common VS Code / Cursor / Windsurf extension directories, hash-compared against the known-malicious build
• Running processes / crontab for references to the known C2 host or persistence task name

Config heuristics (configscan.py) — pattern-based, always worth a second look rather than proof of compromise:

• Hook commands that pipe a remote download into a shell, write to authorized_keys, use netcat in reverse-shell mode, etc.
• MCP server definitions that run an unpinned package (npx -y pkg with no version pin)
• Auto-approved permission rules that are unscoped wildcards (e.g. Bash(*))

New incidents can be added to iocs.py as data, without touching the check logic.

Limitations

This is a lightweight triage tool, not an endpoint-security product. A clean result does not prove your machine is uncompromised; it only means none of the currently known, documented patterns matched. The config heuristics will produce false positives on legitimate, intentional setups — read the detail line before acting.

Development

pip install -e ".[dev]" 2>/dev/null || pip install -e .
pip install pytest
pytest

References

• doublepulsar.com: "Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"
• dev.to/@slabb: "A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"

License

MIT, see LICENSE.