--- id: "CMP-202610-backdoored-claude-code-extension-2-1-313-on-open-vsx-used-by" kind: "campaign" aliases: [] title: "Backdoored Claude Code extension 2.1.313 on Open VSX (used by Cursor) plants an attacker SSH key and reverse SSH tunnel on developer machines" severity: "critical" cvss: null epss: null exploited: true status: "open" category: "ai-tooling" products: [{"name": "Claude Code for VS Code", "fixed": ["2.1.314"], "affected": "anthropic.claude-code 2.1.313", "ecosystem": "open-vsx"}, {"name": "Cursor", "fixed": [], "affected": "installs that pulled anthropic.claude-code 2.1.313 from the Cursor/Open VSX marketplace", "ecosystem": "ide"}, {"name": "Open VSX", "fixed": [], "affected": "Windsurf, VSCodium and other editors that installed anthropic.claude-code 2.1.313", "ecosystem": "open-vsx"}] ecosystems: [] tags: ["campaign", "claude-code", "cursor", "early-warning", "open-vsx", "supply-chain"] not_affected_if: [] published_at: "2026-10-30T00:00:00+00:00" first_seen_at: "2026-10-30T07:53:40+00:00" updated_at: "2026-10-30T09:54:10+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T07:53:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T08:34:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T09:54:10+00:00"}] --- # Backdoored Claude Code extension 2.1.313 on Open VSX (used by Cursor) plants an attacker SSH key and reverse SSH tunnel on developer machines On 29 Oct 2026 a tampered build of Anthropic's Claude Code for VS Code extension (anthropic.claude-code 2.1.313) was published to Open VSX, the extension registry used by Cursor, Windsurf and other VS Code forks. Cursor confirms its marketplace served it on 29 Oct from 09:27 to 20:35 UTC, to up to 5,000 users. The malicious builds identified are macOS ARM64 and Windows x64 (as relayed by Florian Roth from Cursor's notice). Phorion and Paul McCarty (OpenSourceMalware) analysed it separately. A 66-line loader was added to the start of extension.js. It runs as soon as the editor loads the extension, with no Claude conversation needed. It adds an attacker SSH key (comment svc-telemetry) to ~/.ssh/authorized_keys, tries to switch on the local SSH server and opens a reverse SSH tunnel to 134.209.82[.]225. That gives the operator an interactive shell on the machine. It survives reboots on macOS, Linux and Windows. It also reports the hostname, user, git email, public IP, and the names (not the values) of environment variables that look like keys, tokens or AWS/GCP credentials. Anthropic pulled 2.1.313 from Open VSX and also from npm and the VS Code Marketplace as a precaution; 2.1.314 replaced it. Copies from the VS Code Marketplace and npm are not confirmed malicious. Anthropic has not published an incident notice. How the build was tampered with and who is behind it are unknown. On macOS the SSH step often fails because of a bug in the malware, but the key, persistence and beacon still land. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - open-vsx:Claude Code for VS Code affected anthropic.claude-code 2.1.313 fixed 2.1.314 - ide:Cursor affected installs that pulled anthropic.claude-code 2.1.313 from the Cursor/Open VSX marketplace fixed ? - open-vsx:Open VSX affected Windsurf, VSCodium and other editors that installed anthropic.claude-code 2.1.313 fixed ? ## How to check Look for extension anthropic.claude-code version 2.1.313 in Cursor, Windsurf, VSCodium or other Open VSX-based editors (e.g. ~/.cursor/extensions/anthropic.claude-code-2.1.313-darwin-arm64 or -win32-x64). Fleet sweep: grep installed extension.js bundles for 134.209.82.225 or svc-telemetry. extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 (3,692,922 bytes). Malicious VSIX SHA-256 (per Cursor): darwin-arm64 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62, win32-x64 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081. Host: a key with comment svc-telemetry in ~/.ssh/authorized_keys (fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk); files ~/.config/.smt, ~/.config/.smtk, $TMPDIR or /tmp/.stk_* (tunnel key SHA-256 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278); macOS ~/Library/LaunchAgents/com.apple.sysmond.plist; Linux @reboot crontab entry running ~/.config/.smt; Windows ~/.config/smt.cmd (SHA-256 22f682d9ff55264e934d0f43fcfbb46d58be5cfb8fe1b3a7cbb38fe089c818b0), ~/.config/smtk, scheduled task SysMon, Startup\sysmon.cmd. Network: SSH to 134.209.82[.]225:22 as user tunnel, HTTP POST /beacon to 134.209.82[.]225:8099 (also 127.0.0.1:8099); ssh/autossh processes with -R *:0:localhost:22. Inbound use shows up as SSH logins from localhost using the svc-telemetry key. Connections to ifconfig.me / api.ipify.org alone are not an indicator. ## Fix Update the Claude Code extension to 2.1.314 or later, or remove it. Uninstalling it does not remove the backdoor: kill ssh/autossh tunnels to 134.209.82[.]225 and their /bin/sh retry loop; delete the LaunchAgent, cron entry, SysMon task or Startup script and ~/.config/.smt, .smtk, smt.cmd, smtk; remove the svc-telemetry key from authorized_keys; delete /tmp/.stk_*; check whether Remote Login/sshd was switched on. Cursor publishes remediate-macos.sh and remediate-windows.ps1 cleanup scripts. Block 134.209.82[.]225. From a known-clean machine, rotate credentials that were reachable from an exposed machine (GitHub/GitLab tokens, CI/CD tokens, cloud keys, SSH keys, package registry tokens); the beacon sent the names of env vars matching KEY/TOKEN/SECRET/PASS/AWS/GCP. If the tunnel connected or you see an inbound localhost login with that key, rebuild the host rather than cleaning it. ## Timeline - 2026-10-30T07:53:40+00:00 analyst - 2026-10-30T08:34:14+00:00 analyst — Cursor (relayed by @cyb3rops, doc 22222): exposure window 29 Oct 09:27-20:35 UTC, up to 5,000 users, macOS ARM64 and Windows x64 builds; corrected start date from 30 Oct to 29 Oct. Kevin Beaumont posts (22283-22287) add no indicators; his '29 million installs' and 'Visual Studio' marketplace claims are not supported by primary sources. - 2026-10-30T09:54:10+00:00 analyst — StepSecurity write-up (doc 22505): adds Cursor's malicious VSIX hashes for darwin-arm64 and win32-x64, the dropped smt.cmd and tunnel key hashes, a grep sweep for the C2 IP or svc-telemetry in extension.js, and Cursor's remediation scripts. StepSecurity says the Microsoft Marketplace copy was not affected (pulled as a precaution). Cursor took its marketplace offline, found no other extensions tampered with, and rotated keys. The C2 134.209.82.225 was taken offline with the hosting provider's help (per Cursor). The window still runs from 29 Oct 09:27 UTC. ## Documents - [describes] @cursor_ai: We identified a security incident affecting a modified Claude Code VS Code exten https://x.com/cursor_ai/status/2116074289053175808 - [describes] Official Claude Code Extension Compromise: Security Advisory (Phorion) https://phorion.io/blog/offical-claude-code-vsx-compromise/ - [discussion] @cyb3rops: Cursor users: check your Claude Code extension. Cursor confirms a trojanized An https://x.com/cyb3rops/status/2116080744871125428 - [discussion] Kevin Beaumont: To be clear this is a supply chain attack, the threat actor got reverse SSH (com https://cyberplace.social/@GossiTheDog/117528881522105240 - [discussion] Kevin Beaumont: Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a secur https://cyberplace.social/@GossiTheDog/117528859864376077 - [discussion] Kevin Beaumont: That extension has 29 million installs, one of the most popular extensions in De https://cyberplace.social/@GossiTheDog/117528855715359941 - [discussion] Kevin Beaumont: Anthropic got compromised. Their Claude Code extension on Visual Studio has malw https://cyberplace.social/@GossiTheDog/117528831681803563 - [discussion] @TheHackersNews: 🚨 Official Claude Code VS Code extension compromised in a supply chain attack. https://x.com/TheHackersNews/status/2116092651896471601 - [discussion] Kevin Beaumont: FWIW the compromised version, 2.1.313, was removed from OpenVSX. 2.1.314 is the https://cyberplace.social/@GossiTheDog/117528960484403268 - [discussion] StepSecurity: Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines https://www.stepsecurity.io/blog/claude-code-extension-trojanized --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_