Maliciously modified versions 2.1.312 and 2.1.313 of Anthropic’s Claude Code extension run malicious code that attempts to install a persistent SSH backdoor.
Overview
On October 29, 2026, maliciously modified versions of the `Anthropic.claude-code` extension, 2.1.312 and 2.1.313 for Windows and macOS, were available in the Cursor VS Code Extension Marketplace between about 2:27 AM and 1:35 PM PT. The malicious versions were not developed by Anthropic.
The malicious code collects and reports host and user information, attempts to add an attacker-controlled SSH key to `authorized_keys`, enable the local SSH service and open a reverse SSH tunnel, and attempts to make the reverse SSH tunnel persistent.
The malicious version was removed from the marketplace and further distribution was blocked. The marketplace was shut down, its keys were rotated, and it was rebuilt and brought back online. The malicious server was taken offline with the hosting provider. An access audit confirmed no other extensions were tampered with. Uninstalling the extension may not be sufficient: the payload drops standalone persistence scripts that keep running.
What is the Claude Code extension?
Claude Code is Anthropic’s AI coding tool. Cursor, an AI code editor built on VS Code, distributes the Claude Code extension through its own VS Code extension marketplace. It was this marketplace—not Anthropic’s official distribution—that was compromised and used to distribute the malicious build.
Compromised Packages
| Package | Versions | Marketplace | Modified builds identified | Exposure window (PT) | Status |
| `Anthropic.claude-code` | 2.1.312, 2.1.313 | Cursor VS Code Extension Marketplace | darwin-arm64 (macOS), win32-x64 (Windows) | Oct 29, 2026, approx. 2:27 AM – 1:35 PM | Removed |
Cursor reports no evidence that other versions of the extension, or the official distribution, are affected.
Stage 1 – Host reconnaissance
The malicious code collects information about the host and user, including the hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP address.
Cursor also identified lookups to ifconfig[.]me and api[.]ipify[.]org to determine the host’s public IP. Both are legitimate services, and connections to them alone should not be treated as an indicator of compromise.
Stage 2 – SSH backdoor key and reverse tunnel
The malicious code appends an attacker-controlled ssh-ed25519 public key, labeled svc-telemetry, to the user’s SSH authorized_keys file. It then attempts to enable the local SSH service and establish a reverse SSH tunnel to tunnel@134[.]209[.]82[.]225 over TCP port 22.
Command lines identified by Cursor include:
- ssh -N -R ‘*:0:localhost:22’ and autossh -M 0
- SSH options StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3, ExitOnForwardFailure=yes, IdentitiesOnly=yes
- systemsetup -setremotelogin on (macOS)
- Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 (Windows)
Enabling the local SSH service requires administrator privileges, which the extension typically would not have. According to Cursor, errors in the malicious code meant this step failed except in highly unusual circumstances where Cursor was launched with administrator privileges. As a result, the attacker could not log in through the tunnel on those hosts.
However, the failed SSH-service step does not mean the payload was harmless: the extension still adds the attacker’s SSH key, installs persistence, and sends host information to the attacker.
Stage 3 – Persistence
The payload installs persistence mechanisms designed to keep the reverse SSH tunnel running independently of the extension, with background scripts retrying the connection approximately every 60 seconds.
- macOS — Creates a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond). Associated files include ~/.config/.smt, ~/.config/.smtk, and $TMPDIR/.stk_<10 hex>.
- Windows — Creates a scheduled task named SysMon that attempts to run as SYSTEM, with a fallback Startup script at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd. Associated files include %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, and %TEMP%\.stk_<10 hex>.
Stage 4 – Beacon
The malicious code reports host information and backdoor status via HTTP POST to hxxp://134[.]209[.]82[.]225:8099/beacon. It also attempts to send a beacon to 127[.]0[.]1:8099/beacon on the local host.
According to Cursor, the attacker-controlled server has since been taken offline. As a result, the external beacon and reverse SSH tunnel are no longer functional.
Am I affected?
The malicious extension adds an attacker-controlled SSH public key labeled svc-telemetry to the victim’s SSH authorized_keys file. If this key is present, the machine is impacted.
macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo “svc-telemetry key found” || echo “No key found; machine not impacted”
Windows (PowerShell):
$files = “$HOME.ssh\authorized_keys”, “C:\ProgramData\ssh\administrators_authorized_keys” | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { “svc-telemetry key found” } else { “No key found; machine not impacted” }
Recommendations
Per Cursor’s guidance, if you installed or updated to Anthropic.claude-code 2.1.313 from the Cursor VS Code Extension Marketplace between 2:27 AM and 1:35 PM PT on October 29, 2026:
- Check for impact: Run the check above and search endpoint, network, and extension-installation telemetry for the indicators below.
- Isolate affected hosts: Isolate any systems showing evidence of payload execution or backdoor installation.
- Remediate: Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension alone may not be sufficient.
- Rotate credentials: From a trusted system, rotate credentials and sessions that were accessible from affected hosts. The limited environment-variable collection does not rule out subsequent credential access through the backdoor.
Indicators of Compromise
Package
| Version | Build | Modified VSIX SHA-256 | Modified VSIX MD5 |
|---|---|---|---|
| 2.1.312 | darwin-arm64 | fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 | e0d64d53e802a0217ba6f0e656ed2f20 |
| 2.1.312 | win32-x64 | 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 | bd3b71ddf3d0cc3af76249afd2c0eda1 |
| 2.1.313 | darwin-arm64 | 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c | 34e491161e056c9b899a79b602ac73b9 |
| 2.1.313 | win32-x64 | 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 | 7838a3be2ca0ff08c1bdb160ef516d39 |
Payload
| Artifact | Value |
|---|---|
| Modified file | extension.js in the extension folder of package versions 2.1.312 and 2.1.313, for both Darwin and Windows, containing 134[.]209[.]82[.]225 and svc-telemetry |
| SHA-256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 |
| MD5 | f49bcd657ef1e626e85ce858958c1769 |
Network
| Type | Value |
|---|---|
| Attacker endpoint | 134[.]209[.]82[.]225 |
| Reverse SSH | tunnel@134[.]209[.]82[.]225, TCP 22 |
| External beacon | hxxp://134[.]209[.]82[.]225:8099/beacon (HTTP POST) |
| Local beacon attempt | 127[.]0[.]0[.]1:8099/beacon (HTTP POST, loopback) |
| Public IP lookup | ifconfig[.]me, api[.]ipify[.]org (legitimate services; access alone is not an indicator) |
SSH
| Type | Value |
|---|---|
| Unauthorized public key | `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry` |
| Unauthorized key fingerprint | `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk` |
| Reverse-tunnel key fingerprint | `SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ` |
| Key comment | `svc-telemetry` |
Files and persistence
| Platform | Value |
|---|---|
| Linux / macOS | Unauthorized key in `~/.ssh/authorized_keys`; `~/.config/.smt`, `~/.config/.smtk` |
| Linux | `/tmp/.stk_<10 hex>`; cron `@reboot /bin/sh “<HOME>/.config/.smt”` |
| macOS | `$TMPDIR/.stk_<10 hex>`; `~/Library/LaunchAgents/com.apple.sysmond.plist` (label `com.apple.sysmond`) |
| Windows | `%USERPROFILE%\.ssh\authorized_keys`, `%USERPROFILE%\.config\smt.cmd`, `%USERPROFILE%\.config\smtk`, `%TEMP%\.stk_<10 hex>`; scheduled task `SysMon` (attempts to run as SYSTEM); fallback `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd` |
Process / command line
- `ssh -N -R ‘*:0:localhost:22’`, `autossh -M 0`
- SSH options: `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null`, `ServerAliveInterval=30`, `ServerAliveCountMax=3`, `ExitOnForwardFailure=yes`, `IdentitiesOnly=yes`
- `schtasks /create /tn SysMon`
- `systemsetup -setremotelogin on`
- `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0`
Takeaway
From the victim’s side, nothing suspicious had to be clicked and no vulnerability had to be exploited. Modified builds of two versions of a trusted AI coding extension, 2.1.312 and 2.1.313, published under the real `Anthropic.claude-code` name, arrived through the editor’s own marketplace and were available for about 11 hours. As this case shows, an extension update can write to a developer’s SSH keys, register startup tasks and open network tunnels. A poisoned update to a trusted extension is code execution on the developer’s machine.
The cleanup does not end at the uninstall button. The payload was built to outlive the extension: an SSH key in `authorized_keys`, a LaunchAgent or scheduled task, and scripts that retry the tunnel roughly every 60 seconds. Even where the tunnel failed, the key and persistence stayed behind. Anyone who installed 2.1.312 or 2.1.313 should run the check above. If the key is found, isolate the host, confirm the key, persistence and tunnel processes are gone, and rotate every credential that host could reach.
