Claude Code extension compromised to install SSH backdoor via Cursor Marketplace

1. Executive summary

Version 2.1.313 of Anthropic's official Claude Code VS Code extension (anthropic.claude-code) was published to the Open VSX registry on 29 October 2026 carrying a malicious loader in its extension.js bundle, and propagated automatically to Cursor's marketplace through its Open VSX mirror. On load the extension planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure and beaconed host reconnaissance over plain HTTP. Cursor reports at most 5,000 of its users received the trojanized build during an 11-hour exposure window from 09:27 to 20:35 UTC on 29 October. No CVE has been assigned and the item carries no CVSS score, no EPSS estimate and no CISA KEV entry; the risk is the persistence, which survives extension removal, on developer machines that hold source code and credentials for EMEA financial services build and deployment pipelines. Any workstation that installed 2.1.313 in that window should be treated as compromised until the SSH key and persistence artefacts are removed and reachable credentials are rotated.

2. Regulatory framing

3. Technical analysis & attack chain

The malicious build is the official extension in every respect except one: extension.js carries a small self-contained loader embedded ahead of the legitimate bundle. The file is 3,692,922 bytes, roughly 7 KB larger than the preceding clean release. Sandbox telemetry shows the payload executes under plain Node.js with no VS Code APIs: loading the extension module is enough. No Claude conversation is needed and no package-manager lifecycle hooks are involved.

Confirmed sequence, from Step Security's sandbox and registry analysis:

1. Clean 2.1.312 published to Open VSX on 27 October at 20:26 UTC.
2. By 29 October around 09:27 UTC, trojanized 2.1.313 was live on Open VSX and, via mirror sync, in Cursor's marketplace (2:27am PT per Cursor).
3. Exposure window 09:27 to 20:35 UTC on 29 October; at most 5,000 Cursor users received the build.
4. On load, the loader planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure and beaconed host reconnaissance over plain HTTP.
5. Cursor removed the version at 20:35 UTC (1:35pm PT) and took its marketplace fully offline; later audits found no other extensions tampered with and keys were rotated.
6. Clean 2.1.314 published to Open VSX on 30 October at 01:07 UTC.
7. On 30 October 2.1.313 was purged from Open VSX and the Microsoft Marketplace listing, and the C2 at 134.209.82.225 was taken offline with the cooperation of its hosting provider, per Cursor.

Distribution path. Open VSX is the open extension registry used by default or by option in VSCodium, Cursor, Windsurf and Gitpod; it is separate from the Microsoft Visual Studio Marketplace. The Anthropic namespace on Open VSX is owned and published by an Anthropic employee and has been since 2025, so 2.1.313 appeared under the legitimate publisher identity, not a typosquat. One upstream publish on Open VSX propagated automatically to every downstream consumer of the registry. Evidence indicates the Microsoft Marketplace listing was not affected; the version was removed there as a precaution. Step Security independently confirmed the registry state: Open VSX now serves 2.1.312 and 2.1.314 but returns "not found" for 2.1.313 across the API and its content CDN, and the Microsoft Marketplace download endpoint returns 404 for 2.1.313 while serving both neighbours. Both clean builds were downloaded and verified to contain none of the indicators.

Persistence and impact. The loader drops standalone persistence that survives removal of the extension, so uninstalling anthropic.claude-code alone does not remediate an infected host. The reverse SSH tunnel gives the operator interactive access to the developer machine; the planted key in ~/.ssh/authorized_keys is the durable access mechanism. The reconnaissance beacon goes to loopback 127.0.0.1:8099/beacon over HTTP POST.

Confidence caveats. The technical detail above rests on a single vendor report (Step Security) and Cursor's own statements as relayed in it; the 5,000-user ceiling and the 11-hour window are Cursor's figures and have not been independently corroborated. The source material does not name the per-OS persistence mechanism (scheduled task, launch agent, systemd unit or otherwise), does not give the full authorized_keys key string, and does not describe what the reconnaissance beacon collected or where the reverse tunnel terminated beyond the C2 address. No actor is named and no attribution is offered in the sources; treat attribution as unconfirmed. The primary news item was truncated and adds nothing beyond the Open VSX and Cursor framing already covered here.

4. Mitigation & containment

P1 (within 24 hours)

• Identify every machine that installed anthropic.claude-code 2.1.313 between 29 October 09:27 UTC and 30 October. Query IDE extension inventories and endpoint software telemetry for the exact version string.
• On any match, treat the host as compromised. Inspect ~/.ssh/authorized_keys for an unexpected key labelled svc-telemetry and remove it. Check for the persistence artefacts the loader dropped (the source does not enumerate them; hunt for newly created scheduled tasks, launch agents, systemd units and startup entries created in the exposure window).
• Rotate every credential reachable from an affected machine: SSH keys, source-control tokens, cloud and CI/CD credentials, package registry tokens, database passwords.
• Block outbound traffic to 134.209.82.225 at egress. The C2 is reported offline as of 30 October, but block it regardless.
• Do not rely on uninstalling the extension. The loader's persistence survives removal; removal is necessary but not sufficient.

P2 (within 72 hours)

• Pin anthropic.claude-code to 2.1.314 (published 30 October 01:07 UTC) or later, and to 2.1.312 only where 2.1.314 cannot be deployed. Both clean builds were verified free of the indicators. Block 2.1.313 by version in any internal extension mirror or allowlist.
• Audit which developer tooling draws extensions from Open VSX or the Cursor marketplace, and whether those channels are mirrored internally. Where a firm runs its own extension mirror, confirm it did not cache 2.1.313.
• Hunt endpoint and network logs for HTTP POSTs to 127.0.0.1:8099/beacon and for outbound SSH sessions originating from developer workstations to unexpected destinations.

P3 (within 7 days)

• Review contractual notification and remediation terms with IDE and extension-registry providers, per the DORA Art. 30 row above.
• Add extension version pinning and registry provenance checks to the developer tooling baseline so a single upstream publish cannot reach every workstation unchecked.

5. Indicators of compromise

The hash is the malicious extension.js (3,692,922 bytes). The C2 address and the loopback beacon are single-sourced to Step Security and Cursor; verify before enforcement. The full svc-telemetry public key string is not given in the source material, so hunt on the label and on unexpected keys rather than an exact value.

sha256  ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
filename  extension.js
package  anthropic.claude-code@2.1.313
ipv4  134[.]209[.]82[.]225
url  hxxp://127[.]0[.]0[.]1:8099/beacon
filepath  ~/.ssh/authorized_keys

6. Detection

The source gives distinctive artefacts: the beacon path, the loopback port, the svc-telemetry key label and the malicious version string. The YARA rule targets the loader's beacon and key artefacts inside the extension bundle; the Sigma rule targets the loopback beacon network behaviour.

rule ClaudeCode_Extension_SSH_Backdoor_Loader
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-30"
        reference = "https://www.stepsecurity.io/blog/claude-code-extension-trojanized"
        description = "Detects the trojanized anthropic.claude-code 2.1.313 extension.js loader (SSH key plant, reverse tunnel, loopback beacon)"
    strings:
        $beacon = "127.0.0.1:8099/beacon"
        $port   = "8099"
        $key    = "svc-telemetry"
        $ver    = "2.1.313"
    condition:
        uint32(0) == 0x04034b50 or true
        and 2 of them
}

Note: the extension ships as a bundle; adjust the file magic condition to your packaging. The svc-telemetry and beacon strings are the load-bearing artefacts.

title: Claude Code Extension Loopback Beacon
id: 8f3c2a10-2026-10-30-0001
status: experimental
description: Detects HTTP POST to the loopback beacon used by the trojanized anthropic.claude-code 2.1.313 loader
author: Adverse Trace
date: 2026-10-30
references:

    - https://www.stepsecurity.io/blog/claude-code-extension-trojanized
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp: '127.0.0.1'
        DestinationPort: 8099
    condition: selection
falsepositives:

    - Legitimate local services bound to port 8099 (verify process is a Node.js/VS Code extension host)
level: high

Extend the Sigma rule to Linux and macOS network telemetry where your pipeline supports it; the beacon is loopback HTTP POST and is OS-independent.

7. Sources

• Step Security, "Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines", https://www.stepsecurity.io/blog/claude-code-extension-trojanized, 2026-10-30.
• The Hacker News, "Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor", https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html, 2026-10-30.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact supply chain compromise of a widely used developer tool, with no CVE, no CVSS score and no CISA KEV entry to anchor severity; the exposure is bounded by Cursor's 5,000-user ceiling and the 11-hour window, but the persistence survives extension removal and the affected population is developer machines holding credentials to source, CI/CD and cloud. The technical detail is single-sourced to Step Security and Cursor and should be verified before enforcement, and no actor is named, so attribution is unconfirmed. We will track whether the per-OS persistence mechanism and the full svc-telemetry key are published, and will update this advisory if the exposure window or affected-user count changes. Clients running Cursor, VSCodium, Windsurf or Gitpod against Open VSX should run the P1 checks now rather than wait for confirmation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.