Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

Summary

A reported compromise of the Cursor Marketplace distributed a modified Claude Code extension identifying itself as anthropic.claude-code version 2.1.313. The package retained legitimate extension code but placed a malicious 66-line JavaScript loader ahead of it. The article corrects an earlier claim that Open VSX was compromised and quotes Cursor stating that Anthropic did not develop the malicious version. The supplied evidence therefore supports a marketplace-distributed supply-chain intrusion, not a demonstrated compromise of Anthropic's development process.^[0]

The payload planted an attacker-controlled SSH key, attempted to make the host accessible through SSH, established a reverse tunnel to 134.209.82.225, installed operating-system-specific persistence, and transmitted reconnaissance over plaintext HTTP on port 8099. Collected information included host and account details, global Git email, and names of selected environment variables. The initial beacon did not directly contain those variables' values, but successful SSH access would let the operator inspect the account.^[0]

Cursor reportedly identified an exposure window of approximately 2:27 a.m. to 1:35 p.m. PT on October 29, 2026, affecting at most 5,000 users who installed the malicious version. That upper bound should not be read as a count of successful SSH compromises. Cursor stated that the extension generally lacked the administrative rights needed to enable SSH on macOS and Windows; where that step failed, tunnel-based login was unavailable, although key installation, persistence, and host-data transmission still occurred. No follow-on payloads were reported as observed.^[0]

By October 30, the malicious version had reportedly been removed, and Anthropic had published version 2.1.314 to Open VSX and Microsoft VS Code Marketplace. Exposed hosts still required explicit cleanup of the SSH key and persistence, together with credential and session rotation. All incident findings here derive from the single supplied news report; its quoted vendor and researcher statements are not independently corroborated by separately supplied source documents. No named actor attribution is established for this incident.^[0]

Attack chain

1. 1. Marketplace delivery: A compromised Cursor Marketplace supplied the modified Claude Code extension as anthropic.claude-code version 2.1.313. The report warns that users configured for automatic extension updates could have received it during the exposure window.^[0]
2. 2. Extension activation and loader execution: The extension was designed to activate after VS Code startup and when its webview opened. A 66-line malicious loader inserted before the legitimate JavaScript bundle executed as part of the modified package.^[0]
3. 3. SSH authorization modification: The payload added an attacker-controlled public key to ~/.ssh/authorized_keys. The key carried the comment svc-telemetry, which the report describes as an attempt to make the entry appear harmless.^[0]
4. 4. Remote-access setup: After planting the key, the malware attempted to make the victim reachable through SSH across Windows, Linux, and macOS and established a reverse tunnel to 134.209.82.225. Cursor stated that failure to enable the local SSH service on insufficiently privileged macOS and Windows hosts prevented login through that tunnel.^[0]
5. 5. Persistence installation: The malware installed platform-specific persistence using a scheduled task on Windows, a crontab on Linux, or a LaunchAgent on macOS. Cursor stated that persistence installation still occurred on hosts where the SSH-enablement step failed.^[0]
6. 6. Host reconnaissance and beaconing: The payload transmitted host and account reconnaissance to 134.209.82.225 on port 8099 at the /beacon path using unencrypted HTTP. The report identifies no observed follow-on payloads and does not establish subsequent operator activity through SSH.^[0]

Disclosure timeline

How it works

The concrete mechanism described is malicious package modification rather than exploitation of a documented software vulnerability. The modified extension's main JavaScript bundle contained a 66-line loader ahead of the legitimate code, allowing malicious behavior to run through the extension's activation path. The supplied report does not explain how the marketplace itself was compromised.^[0]

Remote access depended on more than planting an SSH key. The malware also tried to enable the local SSH service and provide a path to it through a reverse tunnel. Cursor stated that enabling SSH required administrative rights the extension lacked on most macOS and Windows hosts. That limitation constrained tunnel-based login but did not prevent the key modification, persistence installation, or reconnaissance beacon.^[0]

The reconnaissance payload included a public IP address obtained from api.ipify.org, hostname, local username, operating system, CPU architecture, home directory, current working directory, and the global Git email obtained through git config --global user.email. It also collected up to 40 environment-variable names containing KEY, TOKEN, SECRET, PASS, AWS, or GCP. Names rather than values were placed in the initial beacon, revealing configured credential types without directly transmitting their contents in that message.^[0]

The reverse tunnel was described as a pathway to the victim's SSH service, potentially allowing commands and file transfers if SSH access succeeded. The report distinguishes this capability from observed follow-on activity: it states that no additional payloads had been observed.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Distribution provenance is central to scope: the corrected report identifies Cursor Marketplace, not Open VSX, as the compromised distribution point. The package's Anthropic identifier does not establish that Anthropic developed the malicious version.^[0]
• Exposure, backdoor installation, and successful remote access are distinct outcomes. The reported 5,000-user figure is an upper bound on installations, while SSH login depended on the local service being available.^[0]
• A failed SSH-enablement step does not make an exposed host clean. The unauthorized key, persistence, and reconnaissance transmission reportedly remained relevant on those hosts.^[0]
• The initial beacon's omission of environment-variable values limits what that message proves about credential disclosure; it does not eliminate the account-access risk posed by a working SSH backdoor. No observed follow-on payloads and no named actor attribution are established in the supplied report.^[0]

Defensive actions

• Identify endpoints that installed or automatically updated the Cursor-distributed anthropic.claude-code version 2.1.313 during the reported October 29 exposure window.: Cursor reportedly bounded exposure to installations between approximately 2:27 a.m. and 1:35 p.m. PT, and the researcher warned that automatic updates could have delivered the malicious package. Assess provenance alongside the version number because the report scopes distribution to Cursor Marketplace.^[0]
• Isolate hosts identified as having installed the compromised package.: Isolation is explicitly recommended in the report, and the payload attempted persistent SSH access and outbound tunneling to attacker infrastructure.^[0]
• Inspect ~/.ssh/authorized_keys and remove the unauthorized attacker entry, using svc-telemetry as a reported hunting lead.: The payload planted an attacker-controlled SSH key in that file. Cursor stated that the modification still occurred even when the extension could not enable the SSH service.^[0]
• Locate and remove the malicious scheduled task, crontab entry, or LaunchAgent on affected Windows, Linux, or macOS systems respectively.: These were the reported persistence mechanisms. Cleanup is required independently of whether tunnel-based SSH login was possible; the supplied evidence does not provide task names, cron contents, or LaunchAgent filenames.^[0]
• Hunt network telemetry for connections to 134.209.82.225, particularly plaintext HTTP on port 8099 at /beacon and reverse-tunnel activity.: The report identifies that address as both the tunnel destination and the reconnaissance receiver. These connections provide incident-specific leads for identifying exposed endpoints.^[0]
• Rotate credentials and sessions associated with exposed accounts as part of remediation.: The report explicitly recommends rotation. Although the initial beacon contained selected environment-variable names rather than values, successful SSH access would have allowed direct inspection of the account.^[0]
• Replace the malicious extension with the reported newer release, while completing key and persistence removal even if SSH activation failed.: Version 2.1.314 was reportedly published to Open VSX and Microsoft VS Code Marketplace after removal of the malicious package. Cursor expressly advised remediation despite the privilege limitation because other malicious host changes and data transmission still occurred.^[0]