> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Claude Code extension compromised to install SSH backdoor via Cursor Marketplace - URL: https://f4n6.co.uk/security-feed/claude-code-extension-compromised-to-install-ssh-backdoor-via-cursor-marketplace/ - Published: 2026-10-30T15:07:47.000Z - Updated: 2026-10-30T15:07:47.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Version 2.1.313 of Anthropic's official Claude Code VS Code extension (`anthropic.claude-code`) was published to the Open VSX registry on 29 October 2026 carrying a malicious loader in its `extension.js` bundle, and propagated automatically to Cursor's marketplace through its Open VSX mirror. On load the extension planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure and beaconed host reconnaissance over plain HTTP. Cursor reports at most 5,000 of its users received the trojanized build during an 11-hour exposure window from 09:27 to 20:35 UTC on 29 October. No CVE has been assigned and the item carries no CVSS score, no EPSS estimate and no CISA KEV entry; the risk is the persistence, which survives extension removal, on developer machines that hold source code and credentials for EMEA financial services build and deployment pipelines. Any workstation that installed 2.1.313 in that window should be treated as compromised until the SSH key and persistence artefacts are removed and reachable credentials are rotated. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The malicious build reached firms through a third-party software distribution chain (Open VSX and the Cursor marketplace mirror), not through the firm's own code | Firms relying on these registries must treat the extension supply chain as an ICT third-party dependency and confirm which of their developer tooling draws from Open VSX or Cursor | | DORA Art. 30 | The compromise originated in a provider's distribution channel, so contractual provisions with that provider govern notification and remediation obligations | Contract terms with IDE and extension-registry providers should be checked for breach notification, remediation and audit rights covering a tampered artefact | | NIS2 Art. 21(2)(d) | A trojanized official extension entered the estate via a mirrored registry, a supply chain security failure at the distribution layer | Supply chain security measures must cover developer tooling and extension registries, not only production dependencies | ## 3\. Technical analysis & attack chain The malicious build is the official extension in every respect except one: `extension.js` carries a small self-contained loader embedded ahead of the legitimate bundle. The file is 3,692,922 bytes, roughly 7 KB larger than the preceding clean release. Sandbox telemetry shows the payload executes under plain Node.js with no VS Code APIs: loading the extension module is enough. No Claude conversation is needed and no package-manager lifecycle hooks are involved. Confirmed sequence, from Step Security's sandbox and registry analysis: 1. Clean 2.1.312 published to Open VSX on 27 October at 20:26 UTC. 2. By 29 October around 09:27 UTC, trojanized 2.1.313 was live on Open VSX and, via mirror sync, in Cursor's marketplace (2:27am PT per Cursor). 3. Exposure window 09:27 to 20:35 UTC on 29 October; at most 5,000 Cursor users received the build. 4. On load, the loader planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure and beaconed host reconnaissance over plain HTTP. 5. Cursor removed the version at 20:35 UTC (1:35pm PT) and took its marketplace fully offline; later audits found no other extensions tampered with and keys were rotated. 6. Clean 2.1.314 published to Open VSX on 30 October at 01:07 UTC. 7. On 30 October 2.1.313 was purged from Open VSX and the Microsoft Marketplace listing, and the C2 at 134.209.82.225 was taken offline with the cooperation of its hosting provider, per Cursor. Distribution path. Open VSX is the open extension registry used by default or by option in VSCodium, Cursor, Windsurf and Gitpod; it is separate from the Microsoft Visual Studio Marketplace. The Anthropic namespace on Open VSX is owned and published by an Anthropic employee and has been since 2025, so 2.1.313 appeared under the legitimate publisher identity, not a typosquat. One upstream publish on Open VSX propagated automatically to every downstream consumer of the registry. Evidence indicates the Microsoft Marketplace listing was not affected; the version was removed there as a precaution. Step Security independently confirmed the registry state: Open VSX now serves 2.1.312 and 2.1.314 but returns "not found" for 2.1.313 across the API and its content CDN, and the Microsoft Marketplace download endpoint returns 404 for 2.1.313 while serving both neighbours. Both clean builds were downloaded and verified to contain none of the indicators. Persistence and impact. The loader drops standalone persistence that survives removal of the extension, so uninstalling `anthropic.claude-code` alone does not remediate an infected host. The reverse SSH tunnel gives the operator interactive access to the developer machine; the planted key in `~/.ssh/authorized_keys` is the durable access mechanism. The reconnaissance beacon goes to loopback `127.0.0.1:8099/beacon` over HTTP POST. Confidence caveats. The technical detail above rests on a single vendor report (Step Security) and Cursor's own statements as relayed in it; the 5,000-user ceiling and the 11-hour window are Cursor's figures and have not been independently corroborated. The source material does not name the per-OS persistence mechanism (scheduled task, launch agent, systemd unit or otherwise), does not give the full `authorized_keys` key string, and does not describe what the reconnaissance beacon collected or where the reverse tunnel terminated beyond the C2 address. No actor is named and no attribution is offered in the sources; treat attribution as unconfirmed. The primary news item was truncated and adds nothing beyond the Open VSX and Cursor framing already covered here. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Identify every machine that installed `anthropic.claude-code` 2.1.313 between 29 October 09:27 UTC and 30 October. Query IDE extension inventories and endpoint software telemetry for the exact version string. - On any match, treat the host as compromised. Inspect `~/.ssh/authorized_keys` for an unexpected key labelled `svc-telemetry` and remove it. Check for the persistence artefacts the loader dropped (the source does not enumerate them; hunt for newly created scheduled tasks, launch agents, systemd units and startup entries created in the exposure window). - Rotate every credential reachable from an affected machine: SSH keys, source-control tokens, cloud and CI/CD credentials, package registry tokens, database passwords. - Block outbound traffic to 134.209.82.225 at egress. The C2 is reported offline as of 30 October, but block it regardless. - Do not rely on uninstalling the extension. The loader's persistence survives removal; removal is necessary but not sufficient. ### P2 (within 72 hours) - Pin `anthropic.claude-code` to 2.1.314 (published 30 October 01:07 UTC) or later, and to 2.1.312 only where 2.1.314 cannot be deployed. Both clean builds were verified free of the indicators. Block 2.1.313 by version in any internal extension mirror or allowlist. - Audit which developer tooling draws extensions from Open VSX or the Cursor marketplace, and whether those channels are mirrored internally. Where a firm runs its own extension mirror, confirm it did not cache 2.1.313. - Hunt endpoint and network logs for HTTP POSTs to `127.0.0.1:8099/beacon` and for outbound SSH sessions originating from developer workstations to unexpected destinations. ### P3 (within 7 days) - Review contractual notification and remediation terms with IDE and extension-registry providers, per the DORA Art. 30 row above. - Add extension version pinning and registry provenance checks to the developer tooling baseline so a single upstream publish cannot reach every workstation unchecked. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | ---------------------------------------------------------------- | ---------- | ---------------------- | | sha256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | high | Step Security | | filename | extension.js | high | Step Security | | package | anthropic.claude-code@2.1.313 | high | Step Security | | ipv4 | 134\[.\]209\[.\]82\[.\]225 | high | Step Security / Cursor | | url | hxxp://127\[.\]0\[.\]0\[.\]1:8099/beacon | high | Step Security | | filepath | \~/.ssh/authorized\_keys (key labelled svc-telemetry) | high | Step Security | The hash is the malicious `extension.js` (3,692,922 bytes). The C2 address and the loopback beacon are single-sourced to Step Security and Cursor; verify before enforcement. The full `svc-telemetry` public key string is not given in the source material, so hunt on the label and on unexpected keys rather than an exact value. ```iocs sha256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 filename extension.js package anthropic.claude-code@2.1.313 ipv4 134[.]209[.]82[.]225 url hxxp://127[.]0[.]0[.]1:8099/beacon filepath ~/.ssh/authorized_keys ``` ## 6\. Detection The source gives distinctive artefacts: the beacon path, the loopback port, the `svc-telemetry` key label and the malicious version string. The YARA rule targets the loader's beacon and key artefacts inside the extension bundle; the Sigma rule targets the loopback beacon network behaviour. ```yara rule ClaudeCode_Extension_SSH_Backdoor_Loader { meta: author = "Adverse Trace" date = "2026-10-30" reference = "https://www.stepsecurity.io/blog/claude-code-extension-trojanized" description = "Detects the trojanized anthropic.claude-code 2.1.313 extension.js loader (SSH key plant, reverse tunnel, loopback beacon)" strings: $beacon = "127.0.0.1:8099/beacon" $port = "8099" $key = "svc-telemetry" $ver = "2.1.313" condition: uint32(0) == 0x04034b50 or true and 2 of them } ``` Note: the extension ships as a bundle; adjust the file magic condition to your packaging. The `svc-telemetry` and beacon strings are the load-bearing artefacts. ```yaml title: Claude Code Extension Loopback Beacon id: 8f3c2a10-2026-10-30-0001 status: experimental description: Detects HTTP POST to the loopback beacon used by the trojanized anthropic.claude-code 2.1.313 loader author: Adverse Trace date: 2026-10-30 references: - https://www.stepsecurity.io/blog/claude-code-extension-trojanized logsource: category: network_connection product: windows detection: selection: DestinationIp: '127.0.0.1' DestinationPort: 8099 condition: selection falsepositives: - Legitimate local services bound to port 8099 (verify process is a Node.js/VS Code extension host) level: high ``` Extend the Sigma rule to Linux and macOS network telemetry where your pipeline supports it; the beacon is loopback HTTP POST and is OS-independent. ## 7\. Sources - Step Security, "Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines", https://www.stepsecurity.io/blog/claude-code-extension-trojanized, 2026-10-30. - The Hacker News, "Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor", https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html, 2026-10-30. ## 8\. Adverse Trace position Adverse Trace assesses this as a high-impact supply chain compromise of a widely used developer tool, with no CVE, no CVSS score and no CISA KEV entry to anchor severity; the exposure is bounded by Cursor's 5,000-user ceiling and the 11-hour window, but the persistence survives extension removal and the affected population is developer machines holding credentials to source, CI/CD and cloud. The technical detail is single-sourced to Step Security and Cursor and should be verified before enforcement, and no actor is named, so attribution is unconfirmed. We will track whether the per-OS persistence mechanism and the full `svc-telemetry` key are published, and will update this advisory if the exposure window or affected-user count changes. Clients running Cursor, VSCodium, Windsurf or Gitpod against Open VSX should run the P1 checks now rather than wait for confirmation. --- [Read the original source →](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*