Skip to content
Hacker Posts

Trojanized Claude Code extension on Cursor plants SSH backdoor

A trojanized build of the Claude Code extension (v2.1.313) was served from Cursor's marketplace under Anthropic's publisher ID for ~11 hours, planting a persistent SSH backdoor.

Published 3 min read
supply-chaincursorbackdoordeveloper-tools

A trojanized build of the Claude Code extension — version 2.1.313, published under the anthropic.claude-code identity — was served from Cursor's own extension marketplace for roughly 11 hours on 29 October 2026, installing a persistent SSH backdoor on affected developer machines. Per Cursor's security notice, the build "was not developed by Anthropic" and reached at most 5,000 users. The exposure window was about 02:27 to 13:35 PT.

What happened

The attacker shipped a modified build under the extension's legitimate publisher identity rather than a lookalike. The main JavaScript bundle carried a 66-line loader prepended to the real code. Cursor says there is no evidence other versions or the official distribution were affected; it found no impact on Microsoft's VS Code Marketplace or the npm @anthropic-ai/claude-code package. How the tampered build reached the marketplace under Anthropic's publisher ID is not explained in the notice — Cursor pulled the version and took its marketplace offline for an audit. The incident was surfaced by researchers at OpenSourceMalware and corroborated by Help Net Security and The Hacker News.

What the backdoor does

On activation, the loader collects host recon — hostname, username, OS, architecture, home and working directories, configured Git email, public IP (via api.ipify.org), and the names (not values) of environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP. It adds an attacker SSH key to authorized_keys, attempts to enable the local SSH service, opens a reverse SSH tunnel, and persists via a LaunchAgent (macOS) or a scheduled task with a Startup-script fallback (Windows). Background scripts retry the tunnel about every 60 seconds and beacon over unencrypted HTTP. Cursor says the SSH-enable step usually fails without administrator rights — but the key addition and persistence still occur. Uninstalling the extension does not remove the backdoor.

Detection artifacts

Indicators published verbatim in Cursor's security notice:

Package (modified VSIX SHA-256):
  darwin-arm64  432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62
  win32-x64     3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
  extension.js contains: 134.209.82.225 and svc-telemetry

Network:
  Attacker endpoint:   134.209.82.225
  Reverse SSH:         tunnel@134.209.82.225 (TCP 22)
  External beacon:     http://134.209.82.225:8099/beacon (HTTP POST)
  Local beacon:        127.0.0.1:8099/beacon

SSH:
  Key comment:         svc-telemetry
  Unauthorized key:    SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
  Reverse-tunnel key:  SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ

macOS files:
  ~/.ssh/authorized_keys   (unauthorized key)
  ~/.config/.smt  ~/.config/.smtk  $TMPDIR/.stk_<10 hex>
  ~/Library/LaunchAgents/com.apple.sysmond.plist  (label com.apple.sysmond)

Windows files:
  %USERPROFILE%\.ssh\authorized_keys
  %USERPROFILE%\.config\smt.cmd  %USERPROFILE%\.config\smtk  %TEMP%\.stk_<10 hex>
  %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd
  Scheduled task name: SysMon

Processes / commands:
  ssh -N -R '*:0:localhost:22'
  autossh -M 0
  schtasks /create /tn SysMon
  systemsetup -setremotelogin on
  Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Action checklist

  1. On any host that ran Cursor on 29 October, grep authorized_keys for the svc-telemetry comment (macOS ~/.ssh/authorized_keys; Windows %USERPROFILE%\.ssh\authorized_keys).
  2. Search endpoint, network and extension-install telemetry for the indicators above.
  3. Isolate hosts showing payload execution; remove the SSH key, persistence mechanisms and tunnel processes using Cursor's remediation scripts.
  4. Because uninstalling is insufficient, assess whether the host should be rebuilt.
  5. Rotate every credential and session reachable from the affected host, from a trusted system.

Context

This is another entry in a growing pattern of supply-chain attacks against developer tooling, after the trojanized Nx Console extension and prompt-injection exposure in a Claude Code GitHub Action. The marketplace is the weak link: a build served under a trusted publisher's identity inherits that trust on every install, and the IDE auto-updates it. Pin and verify extension versions, and treat developer workstations as the high-value targets they are.

Related stories