THREATNOIR
Subscribe
Rapid alert3 min read

Trojanised Claude Code extension 2.1.313 planted a persistent SSH backdoor on developer machines

On 29 Oct 2026 a malicious build of the official Claude Code VS Code extension, version 2.1.313, reached Open-VSX and Cursor's marketplace. It plants an attacker SSH key, opens a reverse tunnel and installs persistence. Uninstalling alone does not clean it.

Marcus Lenngren
Marcus Lenngren
Founder, ThreatNoir
Share this alert LinkedIn X Bluesky Reddit Email

Claude Code 2.1.313 rapid alert: Did Cursor update your Claude Code? A stranger's SSH key is on your box.
The rapid alert card: save it and share it with your team

What happened

On 29 October 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. It went out through the Open-VSX registry and Cursor's marketplace, which mirrors Open-VSX. The Microsoft Visual Studio Marketplace never carried the trojanised build.

The file looks like the real extension in every respect except one: a small self-contained loader sits ahead of the legitimate bundle. It runs under plain Node.js as soon as the extension module loads. You do not need to start a Claude conversation, and no package-manager install hooks are involved. Loading the editor is enough.

On load, the payload adds an attacker Ed25519 key to ~/.ssh/authorized_keys with the comment svc-telemetry, tries to enable SSH on the host, opens a reverse SSH tunnel to the attacker server, installs per-OS persistence, and beacons host reconnaissance over plain HTTP to 134.209.82.225 on port 8099.

Cursor reports at most 5,000 of its users received the build during an 11-hour window. The C2 at 134.209.82.225 has since been taken offline with the hosting provider.

Timeline

  • 27 Oct 20:26 UTC: Clean 2.1.312 published to Open-VSX.
  • 29 Oct ~09:27 UTC: Trojanised 2.1.313 live on Open-VSX and, via mirror, in Cursor's marketplace.
  • 29 Oct 09:27 to 20:35 UTC: Exposure window.
  • 29 Oct 20:35 UTC: Cursor removes the version and takes its marketplace offline.
  • 30 Oct 01:07 UTC: Clean 2.1.314 published to Open-VSX.
  • 30 Oct: 2.1.313 purged from Open-VSX and the Microsoft listing. C2 taken offline.

Am I affected?

You are at risk if anthropic.claude-code 2.1.313 was installed or updated on any machine between 29 Oct 09:27 UTC and 30 Oct, through Open-VSX, Cursor or Windsurf. VS Code users on the Microsoft Marketplace were not served the bad build.

The sample analysed targeted macOS on Apple Silicon but carried Linux and Windows branches. Note that enabling SSH often needs admin rights the extension lacks, so on many Macs and Windows hosts the tunnel could not be used. That is not a clean bill of health: on a Mac with Remote Login already on, or one turned on later, the key is ready. Treat any exposed machine as compromised.

What to do now

  1. Isolate any machine that had 2.1.313. Block outbound to 134.209.82.225 on ports 22 and 8099.
  2. Check ~/.ssh/authorized_keys for the svc-telemetry key. Remove it.
  3. Remove the persistence artifacts: ~/.config/.smt, ~/.config/.smtk, ~/.config/smt.cmd, $TMPDIR/.stk_*, the LaunchAgent com.apple.sysmond.plist, and on Windows the SysMon scheduled task and Startup\sysmon.cmd.
  4. Uninstall the extension, then install clean 2.1.312 or 2.1.314. Uninstalling alone does not remove the backdoor.
  5. Rotate every credential, token and session reachable from that machine, using a trusted device to do it.
  6. Preserve evidence before wiping. Consider rebuilding the host to restore confidence.

How to hunt

  • Fleet sweep: grep installed extension bundles for the strings 134.209.82.225 or svc-telemetry. The malicious extension.js has SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 and is 3,692,922 bytes.
  • Look for ssh -N -R '*:0:localhost:22' and autossh -M 0 processes with StrictHostKeyChecking=no.
  • Check for the scheduled objects: task SysMon running as SYSTEM, LaunchAgent com.apple.sysmond, cron @reboot.
  • Check SSH logs for logins from localhost that used the svc-telemetry key: that indicates an operator actually logged in.
  • Watch for the loopback beacon attempt to 127.0.0.1:8099/beacon and HTTP POST to 134.209.82.225:8099/beacon.

What does not help

  • Uninstalling the extension alone. The loader drops standalone scripts that survive removal.
  • Trusting the macOS SSH-enable bug to save you. The faulty check only reduces the odds on some Macs; the key and persistence are still there.

Sources

Pass this alert on LinkedIn X Bluesky Reddit Email

Drafted with the help of AI, then checked, edited and approved by Marcus Lenngren, who takes editorial responsibility for it.

More from us