Malicious Claude Code VS Code Extension on Cursor Marketplace Briefly Installed SSH Backdoors on Thousands of Developers’ Machines

What happened

On October 29, a tampered copy of Anthropic’s Claude Code extension for Visual Studio Code was published in the Cursor extension marketplace for roughly 11 hours (2:27 a.m. – 1:35 p.m. PT). The package, identified as version 2.1.313, appeared to be the legitimate AI‑coding assistant but contained a hidden JavaScript loader that executed as soon as the extension was loaded.

Confirmed malicious behavior

Security researchers at Phorion and OpenSourceMalware dissected the code and reported the following actions when the extension was installed:

• Data collection – the malware harvested the user’s Git email, public IP address, hostname, username and a few environment‑variable names.
• SSH key injection – it dropped an attacker‑controlled SSH public key (named `svc‑telemetry`) into the user’s `~/.ssh/authorized_keys` (macOS) or the equivalent location on Windows.
• Persistence – a macOS LaunchAgent or a Windows scheduled‑task/Startup script was created to re‑run the loader every minute.
• Reverse‑tunnel attempt – the code tried to start an SSH server and open a reverse tunnel to the attacker’s server at 134.209.82.225.

Why many tunnels likely failed

Both Phorion and OpenSourceMalware noted coding mistakes that would stop the backdoor from providing remote access on most systems:

• On macOS, the script checks the output of `systemsetup -getremotelogin` for the word *Off* to decide whether to enable SSH. The command is run without admin rights, producing a permission‑error message instead of the service status, so the condition is never met and SSH is never enabled.
• On Windows, the loader attempts to start the OpenSSH server via `/bin/sh`, a Unix shell that does not exist on standard Windows installations. Consequently the PowerShell command fails.

Because the reverse tunnel requires a running SSH server, the injected key and persistence remain, but the attacker cannot reach the machine unless SSH was already active.

Scope of the incident

• Exposure window – about 5,000 developers may have downloaded the malicious package during the 11‑hour window.
• Distribution source – the only marketplace that hosted the tampered extension was Cursor’s VS Code extension store. Initial rumors about npm, Open VSX or Microsoft’s Marketplace were later disproved.
• Anthropic’s involvement – Anthropic confirmed it did not create the malicious version and has not disclosed how the package was signed under its name.
• Cursor’s response – the company removed the extension, temporarily shut down the entire marketplace for a security audit, rotated all extension‑publisher keys and worked with the hosting provider to take the attacker’s server offline.
• Internal review – Cursor says no other extension versions or the official Claude Code release were affected.

Practical steps for potentially affected developers

1. Check for the rogue SSH key – look for a public key entry containing `svc‑telemetry` in `~/.ssh/authorized_keys` (macOS/Linux) or `%USERPROFILE%\.ssh\authorized_keys` (Windows).
2. Remove the key – delete any matching line and restart the SSH service if it is running.
3. Revoke persistence – delete the LaunchAgent plist in `~/Library/LaunchAgents/` or the scheduled task in Windows Task Scheduler.
4. Rotate secrets – generate new SSH keys, Git credentials and any other tokens that may have been exposed.
5. Isolate and rebuild – if you cannot verify clean‑up, disconnect the machine from the network, back up essential data, and redeploy from a known‑good image.
6. Monitor traffic – watch outbound connections to the IP address `134.209.82.225` and block it at the firewall level.

How to verify the original announcement

• The Cursor blog (or security advisory page) posted a notice on October 30 detailing the removal and remediation steps.
• Phorion’s public analysis (available on their website) includes the full malicious `extension.js` diff and hash of the compromised package.
• OpenSourceMalware’s repository contains the same sample and a timeline of the marketplace activity.

Open questions

• Supply‑chain breach method – it remains unclear whether the attackers compromised Cursor’s publishing pipeline, forged a code‑signing certificate, or exploited a policy loophole to upload the malicious package under Anthropic’s branding.
• Potential further exposure – while Cursor reports no other extensions were affected, the incident highlights the risk of trusting third‑party VS Code extensions without additional verification.

Bottom line: The malicious Claude Code extension briefly exposed thousands of developers to a stealthy SSH backdoor. Although coding errors limited the attacker’s ability to gain remote access, the incident underscores the importance of vetting extensions, monitoring for unexpected SSH keys, and maintaining a rapid incident‑response plan.