Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
TL;DR Highlight
A tampered Claude Code extension on Cursor Marketplace planted an SSH backdoor
Who Should Read
Developers and security staff who run the Claude Code extension in Cursor or VS Code-based editors
Core Mechanics
- Tampered versions are 2.1.312 and 2.1.313
- The Claude Code for VS Code bundle on Cursor Marketplace contained a backdoor.
- Cursor removed both versions from its marketplace.
- The post first listed only 2.1.313 and added 2.1.312 after Cursor's notice.
- It runs the moment the extension loads
- Malicious code (an IIFE) is prepended to the extension file, so it runs before activate is called.
- The user doesn't need to use the extension for it to fire.
- It quietly registers the attacker's SSH key
- It appends an Ed25519 public key commented svc-telemetry to ~/.ssh/authorized_keys.
- It only checks for the comment, so hunting should also use the key fingerprint.
- A reverse SSH tunnel lets the attacker in
- It opens an outbound SSH connection to 134.209.82[.]225 as user tunnel, with -R *:0:localhost:22 forwarding back.
- A detached retry loop every 60 seconds keeps the tunnel up even after the IDE closes.
- It survives reboots
- On macOS it disguises a LaunchAgent as com.apple.sysmond.plist running ~/.config/.smt.
- Linux uses an @reboot crontab entry; Windows uses a SysMon scheduled task or a Startup folder script.
- The macOS SSH-enable logic has a bug
- As a standard user, systemsetup -getremotelogin prints an admin-access error and exits with status 0.
- The script only tries to enable SSH when the output contains Off, so it skips enablement on Macs with SSH off.
- If Remote Login is already on or turned on later, the backdoor works.
- It also sends host info in a beacon
- It sends hostname, username, OS, public IP and git email via plaintext HTTP POST to 134.209.82[.]225:8099/beacon.
- It sends up to 40 environment variable names matching KEY|TOKEN|SECRET|PASS|AWS|GCP, but not their values.
Community Reactions
- A commenter from Anthropic drew a clear line
- The comment says Anthropic's systems and employee laptops were not compromised.
- A malicious actor used access to Cursor's marketplace to publish a tampered copy, and versions on Anthropic's official channels are said to be unaffected.
- A commenter shared check commands
- They quoted Cursor's blog with a macOS grep for svc-telemetry in authorized_keys.
- They also gave a PowerShell check for the user and administrators authorized_keys files on Windows.
- A commenter weighed the scope across Open VSX and the official registry
- One said the affected channel was Open VSX (and so the Cursor marketplace) and the official marketplace build looked clean.
- They noted that 2.1.313 seems never to have been published on Microsoft's official registry.
- A commenter lost two hours because the Cursor scope wasn't clear
- They rotated all API keys and prepared to reimage a machine before learning it was Cursor, not VS Code.
- A commenter pointed out the update delay gap
- They cited VS Code docs saying the auto-update delay does not apply to trusted publishers such as Microsoft, GitHub and OpenAI.
- They complained users can't configure which publishers are trusted.
How to Apply
- Check for infection today
- On macOS, run grep -qs svc-telemetry ~/.ssh/authorized_keys to see if the key exists.
- Also look for anthropic.claude-code-2.1.312 or 2.1.313 in your extensions folders.
- If infected, clean up everything, not just the extension
- Kill ssh, autossh and the /bin/sh retry loop connecting to 134.209.82[.]225.
- Delete com.apple.sysmond.plist, ~/.config/.smt, ~/.config/.smtk and /tmp/.stk_*, and remove the svc-telemetry key from authorized_keys.
- Rotate credentials that were reachable
- If SSH was on or there is any sign of a login, rotate tokens and keys accessible to that account.
- Start with variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.
- Alert on IDE processes touching SSH files in your EDR
- Alert when Code Helper or Cursor Helper writes ~/.ssh/authorized_keys.
- Also flag non-Apple LaunchAgents with com.apple.* labels and LaunchAgents running hidden scripts.
Try It
copy & run
# Paste into macOS Terminal: check commands from the article and Cursor's notice, plus artifact checks
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
ls -la "$TMPDIR"/.stk_* 2>/dev/null
ls -d ~/.*/extensions/anthropic.claude-code-2.1.31[23]* 2>/dev/null
# Next: check for connections to 134.209.82.225
ps aux | grep -E 'ssh|autossh' | grep 134.209.82Terminology
IIFEA JavaScript function that runs as soon as it is defined. Here it made the malicious code fire the moment the file loaded.
Reverse SSH tunnelThe victim machine opens an outbound connection first, and the attacker comes back in through it. It sidesteps firewalls that only block inbound traffic.
authorized_keysA public key listed in this file can log into that account over SSH without a password. It's like secretly registering a copy of your house key.
LaunchAgentA macOS item that runs automatically when a user logs in. Here it was disguised with an Apple-like name to persist across reboots.
BeaconA check-in a compromised machine sends to the attacker. It reports host info once so the operator knows which machines to target.
Related Papers
AI isn't replacing SREs, it's deskilling them
Letting AI handle 95% of incidents may dull the skills SREs need for the critical 5%.
Building an AI-native engineering org
Automating each shipping step raised merges per engineer about 5x with reverts under 0.5%
We ran AI agent swarms in Minecraft and Mindustry
We put 50 agents in Minecraft and they invented ration ledgers and bureaucracy.
The Agent SDK
Cursor released Agent SDK, letting you define agents in code and deploy them with one command.
Here be monsters: What do you still need to know when agents do the work?
Owning agent-written code depends on fundamentals, breadth, and diving deep just in time.
AI promised less work. I've never worked more
Running agents in parallel brought my GitHub activity back to full-time engineer levels, and I'm exhausted.
Show HN: Corgi, a helpful {agent, terminal} multiplexer
A tmux-like terminal tool that shows the status of all your AI agents at a glance
Ask HN: If the models are so good, why doesn't OpenAI just start 100 companies?
HN answers: code is easy, knowing what to build isn't, so they sell tokens instead