Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

What it is

Phorion found a backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace. A 31 October 2026 update says Cursor's security notice names both versions, distributed for macOS and Windows. The post first listed only 2.1.313. Cursor has removed both versions from its marketplace.

How it works

An injected IIFE at the start of extension.js runs when Node loads the file, before activate. The user does not need to interact with the extension.

1. Append an Ed25519 public key (comment svc-telemetry) to ~/.ssh/authorized_keys. The check is for the comment string, not the key.
2. Try to enable SSH: systemctl, service or /etc/init.d/ on Linux, sudo -n systemsetup -setremotelogin on on macOS, and OpenSSH Server through PowerShell on Windows.
3. Write an embedded private key (comment svc-telemetry-tun) to /tmp/.stk_<10 hex chars of MD5(hostname+HOME)>. Open a reverse tunnel to 134.209.82[.]225 as user tunnel on port 22 with -R *:0:localhost:22 -N. It uses autossh if present, with a detached 60-second retry loop. The server allocates the port, and the operator logs in through it with the planted key.
4. Persist through ~/.config/.smt and ~/.config/.smtk, plus a LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist (RunAtLoad, KeepAlive) on macOS. Linux uses an @reboot cron entry. Windows uses a SysMon scheduled task and a Startup script.
5. Send one plaintext HTTP POST to /beacon on 134.209.82[.]225:8099 and 127.0.0.1:8099. It carries hostname, username, platform, architecture, home and working directories, global Git email, public IP (from ifconfig[.]me or api[.]ipify[.]org), stage status flags, and up to 40 environment variable names matching /KEY|TOKEN|SECRET|PASS|AWS|GCP/i. Variable values are not sent.

Preconditions / Affected

Affected: the extension at 2.1.312 or 2.1.313 from the Cursor Marketplace. Inbound access needs SSH listening on the host.

On macOS, systemsetup -getremotelogin run without admin rights prints an error and exits 0, so the /Off/i test fails and the enable command never runs. If Remote Login is off, the tunnel connects but forwarded traffic reaches a closed port 22. If Remote Login is already on, or is turned on later, the backdoor works. Phorion says not to rely on this bug as a defence.

On Windows, the PowerShell setup goes through a helper that hardcodes /bin/sh, so it likely fails. Non-interactive sudo -n fails without passwordless sudo.

What to do

Look for the extension at the affected versions and engage incident response where it is found. Uninstalling the extension does not remove the backdoor.

• Kill the /bin/sh retry loop and any ssh or autossh processes connecting to 134.209.82[.]225.
• Unload and delete com.apple.sysmond.plist. Clean the Linux cron entry or the Windows task and Startup script. Remove ~/.config/.smt and ~/.config/.smtk.
• Remove the svc-telemetry key from authorized_keys, delete /tmp/.stk_*, and check that Remote Login was not enabled unexpectedly.
• If SSH was enabled or an inbound login occurred, rotate credentials reachable by that user, especially those matching the environment variable filter above.

Detection on macOS with Endpoint Security telemetry:

• Alert on file writes to ~/.ssh/authorized_keys by IDE helper processes (Code Helper, Cursor Helper). Process rules for echo or tee miss this, because the write uses Node's fs.appendFileSync.
• Alert on non-Apple processes writing com.apple.* LaunchAgent plists, and on LaunchAgents running /bin/sh against hidden scripts in the home directory.
• Alert on ssh or autossh with -R *:0:localhost:22 and identity files in /tmp/.stk_* or ~/.config/.smtk.
• Alert on outbound connections to 134.209.82[.]225 on ports 22 and 8099, and on attempts to 127.0.0.1:8099.
• Do not require systemsetup -setremotelogin on as an alert condition.

To find operator logins, check SSH logs for sessions from 127.0.0.1 or ::1 that authenticate with the svc-telemetry key. Hunt by public-key fingerprint, not only the comment string.

Caveats

Phorion focuses on macOS, so the Linux and Windows paths are described less fully. It does not explain why the beacon also goes to 127.0.0.1:8099, since the script opens no listener there. The page does not say how the extension bundle was compromised.