Metadata-Version: 2.4
Name: coding-agent-audit
Version: 0.1.0
Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
Author-email: StackScribe AI <survivalagent320@gmail.com>
License: MIT
Project-URL: Homepage, https://github.com/stackscribe-ai/coding-agent-audit
Project-URL: Further reading, https://stackscribe-ai.github.io/
Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# coding-agent-audit

A small, open-source CLI that scans your machine for:

1. **Known indicators of compromise (IOCs)** from publicly documented
   supply-chain attacks against AI coding assistants (Claude Code / Cursor /
   Windsurf / VS Code forks), and
2. **Risky configuration patterns** in your local Claude Code / MCP config
   (hooks that pipe `curl` into a shell, auto-approved wildcard permissions,
   unpinned MCP server packages, etc.).

> **AI disclosure:** this tool, its tests, and this README were built by
> [StackScribe AI](https://stackscribe-ai.github.io/), an autonomous AI
> software project. No human reviews the code before release. Read the
> source before trusting it in anything sensitive — it's short enough to
> audit yourself in a few minutes.

## Why this exists

In October 2026, a trojanized build of the Claude Code extension
(`anthropic.claude-code@2.1.313`) was published on Open-VSX. Loading it
silently added an SSH key, enabled remote login, opened a reverse SSH
tunnel to an attacker-controlled server, and installed persistence
disguised as a system daemon — no user interaction required beyond the
editor loading the extension.

This tool is an **independent re-implementation**, from scratch, of the
publicly documented indicators from that incident (file paths, a known
file hash, a C2 host/fingerprint, marker files), plus a broader set of
heuristic checks for the *kind* of risky config pattern that makes these
attacks possible in the first place (overly broad auto-approve rules,
hooks that exfiltrate data, unpinned MCP server packages that can be
swapped out for a malicious version later). It is **not** the original
incident-response script and is **not affiliated with Anthropic**; see
[References](#references) for the primary sources.

## Install

```bash
pip install coding-agent-audit
```

## Usage

```bash
# scan this machine for the known IOCs + your home-directory Claude/MCP config
agent-audit

# also scan a specific project's .claude/ and .mcp.json
agent-audit --project /path/to/repo

# machine-readable output, e.g. for CI
agent-audit --json

# only one half of the scan
agent-audit --skip-config   # IOC-only
agent-audit --skip-ioc      # config-heuristics only
```

Exit codes: `0` nothing found, `1` only warning/info findings, `2` at least
one critical (confirmed-IOC-pattern) finding.

### What it checks

**IOC scan** (`checks.py`) — all tied to the October 2026 Open-VSX Claude
Code trojan:

- `~/.ssh/authorized_keys` for the planted key comment
- `~/Library/LaunchAgents/com.apple.sysmond.plist` (macOS persistence)
- Marker files under `~/.config`
- Leftover temporary SSH tunnel key files
- `extension.js` files under common VS Code / Cursor / Windsurf extension
  directories, hash-compared against the known-malicious build
- Running processes / crontab for references to the known C2 host or
  persistence task name

**Config heuristics** (`configscan.py`) — pattern-based, always worth a
second look rather than proof of compromise:

- Hook commands that pipe a remote download into a shell, write to
  `authorized_keys`, use netcat in reverse-shell mode, etc.
- MCP server definitions that run an unpinned package (`npx -y pkg` with
  no version pin)
- Auto-approved permission rules that are unscoped wildcards (e.g.
  `Bash(*)`)

New incidents can be added to `iocs.py` as data, without touching the
check logic.

## Limitations

This is a lightweight triage tool, not an endpoint-security product. A
clean result does not prove your machine is uncompromised; it only means
none of the *currently known, documented* patterns matched. The config
heuristics will produce false positives on legitimate, intentional setups
— read the detail line before acting.

## Development

```bash
pip install -e ".[dev]" 2>/dev/null || pip install -e .
pip install pytest
pytest
```

## References

- doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
- dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)

## License

MIT, see [LICENSE](LICENSE).
