Trojanized Claude Code Extension 2.1.313 Deploys Persistent SSH Backdoor

A trojanized build of the Claude Code extension for Visual Studio Code, identified as anthropic.claude-code version 2.1.313, was published to the Cursor marketplace on October 29, 2026. The package contains a 66-line malicious immediately-invoked function expression (IIFE) prepended to the legitimate extension.js bundle. The loader executes on extension activation during VS Code startup or webview open, before any legitimate initialization and without requiring the user to start a Claude conversation (OpenSourceMalware analysis).

Cursor stated the malicious version was not developed by Anthropic, was available for roughly 11 hours (approximately 2:27 a.m. to 1:35 p.m. PT), and affected at most 5,000 users. The company removed the package, audited the marketplace, and worked with the hosting provider to take the command-and-control server offline. Versions 2.1.312 and 2.1.314 have been verified clean. The official npm package @anthropic-ai/claude-code and the Microsoft VS Code Marketplace listing were not observed as malicious in the primary analysis (Cursor security notice).

Technical Analysis of the Loader

Static inspection of the analyzed artifact shows the malicious code occupies the first 66 lines of extension.js. It imports Node.js modules for process, filesystem, operating system, HTTP, and cryptography, then runs an IIFE that suppresses nearly every exception. This design allows the legitimate extension code to continue loading, reducing obvious signs of compromise.

Reconnaissance

At load time the implant collects:

• Hostname and local username
• Operating system and CPU architecture
• Home directory and current working directory
• Global Git email via git config --global user.email
• Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP

Only variable names are included in the initial beacon; values are not exfiltrated by this stage. The names can still indicate cloud providers, CI systems, or credential types present on the host. Successful later SSH access would allow direct inspection of the environment.

Authorized Key Installation

If a home directory exists, the loader creates ~/.ssh with mode 0700 and appends an Ed25519 public key to ~/.ssh/authorized_keys (mode 0600) with the comment svc-telemetry. The key and its fingerprint are:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry
SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk

If the marker is already present, the code records that fact instead of writing a duplicate.

SSH Service Enablement and Reverse Tunnel

The loader attempts platform-specific actions to make the host reachable over SSH:

• macOS: checks Remote Login and enables it if disabled
• Linux: checks for sshd or ssh via systemctl and tries service-start commands
• Windows: uses PowerShell to install OpenSSH Server, set automatic startup, and start sshd

These steps often fail without elevated privileges. Cursor noted that on most macOS and Windows hosts the local SSH service is not enabled, limiting inbound login via the planted key. Failure does not stop the rest of the chain.

The implant then decodes a base64-encoded OpenSSH private key (SHA-256 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278) into a temporary file named .stk_<identifier> (derived from hostname and home directory). It repeatedly connects as tunnel@134[.]209[.]82[.]225 with the options:

-N -R '*:0:localhost:22'

Host-key verification is disabled, the user’s known_hosts file is ignored, and the embedded identity is used exclusively. On Unix-like systems it prefers autossh and reconnects after 60 seconds. The remote side allocates a port that forwards to the victim’s localhost:22. The operator controlling the C2 server can use the tunnel directly.

Platform Persistence

The loader writes supporting scripts and installs OS-specific persistence that survives extension uninstall:

• macOS: Writes ~/.config/.smt and ~/.config/.smtk. Creates a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist (RunAtLoad and KeepAlive) and loads it with launchctl load -w. The label mimics Apple naming but is not an Apple component. .smt reconstructs the tunnel key and relaunches the tunnel.
• Linux: Writes the same files under ~/.config and adds an @reboot crontab entry.
• Windows: Writes .config\smt.cmd and .config\smtk. Attempts to create a scheduled task named SysMon running as SYSTEM. Falls back to copying sysmon.cmd into the user’s Startup folder.

Beacon

After a 1.5-second delay the malware queries public IP via curl to ifconfig.me and api.ipify.org, then POSTs collected JSON to:

• http://127[.]0[.]0[.]1:8099/beacon
• http://134[.]209[.]82[.]225:8099/beacon

The response is discarded. No additional executable or script is downloaded by the injected stage; keys and scripts are generated or decoded from content already inside the extension. The C2 server is reported offline as of the Cursor notice (OpenSourceMalware analysis, Cursor security notice).

Attack Chain and MITRE ATT&CK Mapping

Relevant MITRE ATT&CK techniques include:

• T1204.002 User Execution: Malicious File (extension load)
• T1543.001 / T1053.005 Create or Modify System Process / Scheduled Task (persistence)
• T1098 Account Manipulation (authorized_keys)
• T1021.004 Remote Services: SSH
• T1572 Protocol Tunneling (reverse SSH)
• T1071.001 Application Layer Protocol: Web Protocols (HTTP beacon)
• T1082 System Information Discovery

Detection and Remediation

Uninstalling the extension is insufficient. The persistence scripts and authorized key remain.

Quick checks

• Search authorized_keys for the comment svc-telemetry or the fingerprint above.
• macOS: inspect ~/Library/LaunchAgents/com.apple.sysmond.plist and ~/.config/.smt*
• Linux: check crontab for @reboot entries referencing the tunnel script
• Windows: query scheduled task SysMon and Startup folder for sysmon.cmd
• Look for processes running ssh or autossh with -R '*:0:localhost:22' and temporary files matching .stk_* in $TMPDIR or %TEMP%

Cursor published platform remediation scripts that remove the extension, the planted key, persistence mechanisms, and running tunnel processes. Isolate affected hosts, block 134[.]209[.]82[.]225 on ports 22 and 8099, preserve evidence if required, and rotate credentials and sessions accessible from the host from a clean system. Prefer rebuild when the backdoor had any opportunity for interactive access. Confirm the installed extension is 2.1.314 or later.

Indicators of Compromise

Package [email protected]

Network 134[.]209[.]82[.]225 134[.]209[.]82[.]225:22 hxxp://134[.]209[.]82[.]225:8099/beacon hxxp://127[.]0[.]0[.]1:8099/beacon

SSH tunnel@134[.]209[.]82[.]225 Key comment: svc-telemetry Public key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk Embedded tunnel private key SHA-256: 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278

Files and persistence ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist ${TMPDIR}/.stk_* ~/.config/smt.cmd ~/.config/smtk Scheduled task: SysMon Startup: sysmon.cmd

Hashes (from analysis) extension.js SHA-256: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15

Source: OpenSourceMalware analysis of the Cursor marketplace artifact and Cursor security notice, October 30, 2026.