Trojanized Claude Code Extension Planted an SSH Backdoor on Developer Machines

A tampered build of the Claude Code extension for VS Code was served from Cursor's extension marketplace for roughly eleven hours on 29 October 2026. Anyone who installed or auto-updated to it during that window received a working SSH backdoor, a persistence mechanism on every major desktop OS and a beacon that reported the machine's profile to an attacker-controlled server. Cursor puts the number of affected users at no more than 5,000.

What happened

Cursor has confirmed a security incident in its IDE extension marketplace, which is backed by the Open VSX registry. Between about 02:27 and 13:35 Pacific time on 29 October, the marketplace served a modified package that identified itself as anthropic.claude-code version 2.1.313. Anthropic did not build that package. Cursor briefly took the marketplace offline to remove it and says other extensions distributed through the same channel were not affected.

The malicious version has since been removed, and Anthropic has published a clean 2.1.314 release to both Open VSX and the Microsoft VS Code Marketplace. Cursor says it is contacting impacted users directly. Who is behind the compromise has not been established.

The tampering itself was compact: a 66-line loader was prepended to the extension's main JavaScript bundle. Any error in the loader is silently swallowed and the legitimate extension then starts normally, so from the user's point of view nothing looks wrong.

What the loader does

The implant triggers after VS Code starts and again when the extension's webview opens. It then works through a short but complete intrusion checklist:

• SSH access. It appends an attacker-controlled public key to ~/.ssh/authorized_keys, labelled svc-telemetry so it blends in with legitimate service keys.
• Exposure. It tries to enable the local SSH service on Windows, Linux and macOS, then opens a reverse SSH tunnel to a server at 134.209.82[.]225. The tunnel exposes the victim's port 22 to the operator, reconnects automatically if it drops, and runs with host-key checking disabled.
• Persistence. On Windows it registers a scheduled task that runs as SYSTEM, on Linux an @reboot cron entry, and on macOS a LaunchAgent named to look like an Apple system component. A hidden script under ~/.config rebuilds the key and restarts the tunnel after every reboot.
• Reconnaissance. After a short delay it sends a host profile in clear-text HTTP to port 8099 on the same server.

The profile contains the machine's public IP, hostname, local username, operating system and CPU architecture, home and current working directories, the global Git email address, and the names of up to 40 environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS or GCP. The values of those variables are not included in the initial beacon, but their names alone tell the operator which cloud providers, CI systems and credential types live on the box. A successful SSH login would let them read the values directly.

One mitigating detail: turning on the SSH service requires administrator rights, which the extension does not have on most macOS and Windows hosts. On those machines the tunnel login fails. The key is still planted, persistence is still installed and the beacon is still sent, so every install during the window should be treated as compromised regardless of platform. No second-stage payload has been observed so far.

Why it matters

Developer workstations are among the most valuable targets in any organisation. They hold cloud keys, CI tokens, Git credentials, signing material and source code, and they usually have broad network access. A reverse SSH tunnel is not a passive data leak; it is interactive access that lets an operator run commands and move files at will.

Auto-update made the attack frictionless. A developer did not have to click anything; an IDE configured to keep extensions current could have pulled the malicious build on its own.

This is also the second compromise of developer tooling distribution in about a week. Days earlier, the release binaries of a cloud provider's official command-line tool were replaced with credential-stealing malware through a hijacked maintainer account. Attackers have clearly identified the distribution layer of developer tools as a soft spot, and marketplaces, registries and release pipelines are now part of the threat model.

What to do

1. Check exposure. Confirm whether anthropic.claude-code 2.1.313 was installed from Cursor's marketplace between 02:27 and 13:35 PT on 29 October 2026. Auto-updates count.
2. Isolate affected hosts from the network before doing anything else.
3. Remove the key. Delete the svc-telemetry entry from ~/.ssh/authorized_keys and review the file for anything else you do not recognise.
4. Strip persistence. Remove the scheduled task on Windows, the @reboot cron entry on Linux, the rogue LaunchAgent on macOS, the hidden script under ~/.config and any leftover .stk_* key files in the temp directory.
5. Cut the channel. Kill any ssh or autossh process pointing at 134.209.82[.]225, block that address at the egress firewall, and search proxy and firewall logs for connections to it, particularly on port 8099.
6. Rotate everything. Treat every credential present on the machine as exposed: cloud access keys, API tokens, Git and package-registry credentials, SSH keys, and active sessions. The list of environment-variable names the beacon collected is effectively the attacker's shopping list.
7. Update and tighten. Install 2.1.314 from an official marketplace, and review which extensions are allowed to auto-update and from which sources.
8. Scale it up. Organisations should treat this as an incident, not a per-developer cleanup, and verify remediation across all machines that run the affected IDE.

The hardest part of an incident like this is the long tail: credentials harvested from one developer laptop tend to resurface weeks later on underground markets. Our Deep/Dark Web monitoring team watches for exactly that, flagging leaked tokens, keys and developer accounts tied to your organisation so a quiet exposure does not turn into the next breach.