Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines

What it is

Version 2.1.313 of the official Claude Code VS Code extension (anthropic.claude-code) carried a malicious loader ahead of the legitimate bundle in extension.js. It was live from about 09:27 UTC on 29 October 2026 and was removed by Cursor at 20:35 UTC the same day. The file is 3,692,922 bytes, about 7 KB larger than clean 2.1.312, with SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. It was published under the legitimate Anthropic namespace on Open VSX, not a typosquat. Cursor's marketplace mirrors that registry and passed the build on. Cursor says at most 5,000 of its users received it.

How it works

The payload runs under plain Node.js with no VS Code APIs. Loading the module is enough: no Claude conversation is needed and no package-manager lifecycle hooks are involved. On load it plants an attacker SSH key labelled svc-telemetry, installs per-OS persistence, opens a reverse SSH tunnel to attacker infrastructure and beacons host recon over plain HTTP. The beacon collects the names of environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP, which tells the attacker which credentials a machine holds.

Preconditions / Affected

• Anyone who installed 2.1.313 between 29 October 09:27 UTC and 30 October, mainly through Cursor or other Open VSX consumers (VSCodium, Windsurf, Gitpod).
• The Microsoft Marketplace listing was not affected by the evidence, though the version was removed there as a precaution.
• 2.1.312 (27 October) and 2.1.314 (30 October, 01:07 UTC) were downloaded and checked by StepSecurity and contain none of the indicators.
• Interactive SSH access was granted only where the tunnel succeeded, which the page says was primarily elevated-editor runs.

What to do

Check for the implant:

grep svc-telemetry ~/.ssh/authorized_keys

On Windows, inspect %USERPROFILE%\.ssh\authorized_keys. Then, in this order:

1. Collect evidence, then remove persistence: LaunchAgent com.apple.sysmond.plist, the SysMon scheduled task or Startup\sysmon.cmd, cron @reboot entries, ~/.config/.smt, .smtk, smt.cmd, and $TMPDIR/.stk_* key files. Cursor publishes remediate-macos.sh and remediate-windows.ps1 for this.
2. Remove 2.1.313 and install 2.1.314 or later. Uninstalling alone leaves the standalone persistence in place.
3. From a known-clean machine, rotate source-control tokens (GitHub, GitLab), CI/CD tokens, cloud keys, SSH keys and package registry tokens.
4. Review SSH, shell, process and authentication logs. If the tunnel is confirmed to have connected, rebuild the host rather than cleaning it.

The C2 was at 134.209.82.225 and was taken offline on 30 October, per Cursor. Traffic to ifconfig.me, api.ipify.org and ordinary Microsoft hosts is not an indicator on its own.

Caveats

• The page lists the payload's behavior as verified by sandbox and registry analysis, but does not say how the malicious build got published.
• The exposure figure and the takedown timeline come from Cursor, not from StepSecurity's own measurement.
• Cursor's security notice holds further detection guidance. The page defers to it for the full walkthrough.
• StepSecurity's own detection (Dev Machine Guard) matches by version only.