Trojanized Claude Code extension compromises Cursor IDE users

1. Executive summary

Version 2.1.313 of the official Anthropic Claude Code VS Code extension (anthropic.claude-code) was published to the Open-VSX registry on 2026-10-29 carrying a malicious loader prepended to its extension.js bundle, and propagated automatically through Cursor's Open-VSX mirror to at most 5,000 Cursor users during an 11-hour window (09:27 to 20:35 UTC). The loader executes under plain Node.js on module load, plants an attacker SSH key in ~/.ssh/authorized_keys, installs per-OS persistence, opens a reverse SSH tunnel to attacker infrastructure, and beacons host reconnaissance over plain HTTP. No CVE has been assigned and no CISA KEV entry exists; the risk is supply-chain compromise of a trusted publisher identity rather than an exploitable software flaw. For EMEA financial services, the exposure is concentrated in engineering and platform teams running Cursor or other Open-VSX consumers, where a compromised developer workstation holds source access, CI credentials and cloud tokens. The malicious build was removed and the C2 taken offline, but the dropped persistence survives extension removal, so any host that ran 2.1.313 must be treated as compromised until the artifacts are cleared and credentials rotated.

2. Regulatory framing

3. Technical analysis & attack chain

The compromise is a supply-chain injection into a legitimate, correctly-signed-by-identity extension. The Anthropic namespace on Open-VSX is owned and published by an Anthropic employee, so 2.1.313 appeared under the real publisher, not a typosquat. One upstream publish on Open-VSX propagated automatically to every downstream consumer of the registry, including Cursor's marketplace, which serves the extension via its Open-VSX mirror. Evidence indicates the Microsoft Visual Studio Marketplace listing was not affected; the version was removed there as a precaution.

Confirmed attack chain:

1. Clean 2.1.312 published to Open-VSX on 2026-10-27 20:26 UTC.
2. By 2026-10-29 ~09:27 UTC, trojanized 2.1.313 was live on Open-VSX and, via mirror sync, in Cursor's marketplace (2:27am PT per Cursor).
3. Exposure window 09:27 to 20:35 UTC on 2026-10-29; at most 5,000 Cursor users received the build.
4. On module load, the injected loader executes under plain Node.js before the extension's normal activate callback runs. No Claude conversation is needed and no package-manager lifecycle hooks are involved.
5. The loader plants an attacker SSH key in the user's ~/.ssh/authorized_keys, opens an outbound SSH connection to attacker infrastructure to create a reverse tunnel, installs per-OS persistence, and beacons host reconnaissance over plain HTTP.
6. Cursor removed the version at 20:35 UTC (1:35pm PT) and took its marketplace fully offline; later audits found no other extensions tampered with and keys were rotated.
7. Clean 2.1.314 published to Open-VSX on 2026-10-30 01:07 UTC. 2.1.313 was purged from Open-VSX and the Microsoft Marketplace listing, and the C2 at 134.209.82.225 was taken offline with the cooperation of its hosting provider, per Cursor.

Loader mechanism. The malicious extension.js (SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, 3,692,922 bytes) is roughly 7 KB larger than the preceding clean release. It starts with an injected immediately invoked function expression (IIFE) prepended to the minified bundle; the rest of the bundle looks standard, with Claude Code and VS Code strings, normal activate and deactivate exports, and UI code. The injected prefix pulls in standard Node.js modules (child_process, fs, os, path, http, crypto) and executes as soon as Node loads the file. The payload runs under plain Node.js with no VS Code APIs; loading the extension module is enough.

Persistence. Per-OS: on macOS it installs a startup file with an Apple-style name; on Linux it adds a cron entry that runs at reboot; on Windows it tries to create a scheduled task named SysMon and falls back to the Startup folder if that fails. The reverse SSH tunnel keeps running after the editor is closed and the malware retries the connection about every 60 seconds.

Reconnaissance. The extension reports to the attacker's server the machine's hostname, username, operating system, home directory, working directory, Git email address and public IP address. It also sends the names (not values) of up to 40 environment variables that look like keys, tokens, passwords or AWS and GCP credentials. The values stay on the machine, but the list gives the operator an inventory of which hosts hold cloud credentials or API tokens and which to target first.

macOS limitation. The planted key only works if the machine's SSH service is running, and on macOS the step that turns it on often never runs. The script asks the system whether Remote Login is off without administrator rights, gets an error, and skips the step that would enable SSH. This is not a defence: on a Mac with Remote Login already enabled, or one where the user enables it later, the backdoor is ready to use. Cursor states that turning on SSH requires admin rights the extension lacks on most Mac and Windows hosts.

Confidence caveats. The technical mechanism, persistence detail and reconnaissance behaviour are reported by Step Security and Phorion (the latter via Help Net Security); the two accounts are consistent but this is a small set of vendor analyses, so treat the specifics as single-to-few-sourced and verify against your own telemetry before relying on them for enforcement. The affected-user count (at most 5,000) and the exposure window come from Cursor's own notice. No actor attribution is available in the source material, and none is asserted here.

4. Mitigation & containment

P1 (within 24h). Determine whether anthropic.claude-code 2.1.313 was installed on any host between 2026-10-29 09:27 UTC and 2026-10-30. Check extension install records and IDE logs for the version string. On any host that ran it, treat the machine as compromised: inspect ~/.ssh/authorized_keys for the svc-telemetry key and remove it, remove the persistence artifacts (macOS startup file, Linux cron entry, Windows scheduled task SysMon or Startup-folder entry), and rotate every credential reachable from that machine (SSH keys, Git tokens, cloud API tokens, CI secrets). Uninstalling the extension alone is not sufficient; the loader drops standalone persistence that survives removal. Block outbound connections to 134.209.82.225 at egress.

P2 (within 72h). Hunt for the loopback beacon to 127.0.0.1:8099/beacon (HTTP POST) and for outbound SSH sessions to unexpected external hosts that persist after the editor closes and retry roughly every 60 seconds. Review environment-variable exposure on affected hosts: the payload enumerated names of up to 40 credential-like variables, so assume the operator knows which hosts hold cloud and API tokens and prioritise rotation accordingly. Where a host cannot be cleaned with confidence, rebuild it.

P3 (within 7 days). Pin developer tooling to known-good extension versions and verify the registry state before rollout; Open-VSX now serves 2.1.312 and 2.1.314 and returns "not found" for 2.1.313. Add integrity and version-change monitoring on extension pulls from Open-VSX and any mirror (Cursor, VSCodium, Windsurf, Gitpod). Restrict or alert on IDE extensions that open outbound SSH tunnels or write to authorized_keys. Review whether developer workstations need standing cloud credentials at all, and scope tokens to reduce what a single compromised host exposes.

5. Indicators of compromise

sha256  ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
package  anthropic.claude-code@2.1.313
ipv4  134[.]209[.]82[.]225
url  hxxp://127[.]0[.]0[.]1:8099/beacon
ssh_key_comment  svc-telemetry
scheduled_task  SysMon

The C2 IP and loopback beacon are single-sourced to Step Security and Cursor's notice; verify before enforcing blocks. The svc-telemetry key comment and SysMon task name are from the vendor analyses and should be confirmed against host telemetry.

6. Detection

rule Trojanized_ClaudeCode_Extension_Loader
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-30"
        reference = "https://www.stepsecurity.io/blog/claude-code-extension-trojanized"
        description = "Detects the injected IIFE loader prepended to the Claude Code extension.js bundle in version 2.1.313"
    strings:
        $m1 = "child_process"
        $m2 = "authorized_keys"
        $m3 = "svc-telemetry"
        $m4 = "SysMon"
        $m5 = "8099/beacon"
        $m6 = "134.209.82.225"
    condition:
        uint32(0) == 0x6a732e or filesize > 1MB and 3 of them
}

title: Claude Code Extension SSH Backdoor Persistence and Beacon
id: 8f2c1a4e-7b3d-4c9a-9e21-5d6f0a1b2c3d
status: experimental
description: Detects persistence and beacon behaviour of the trojanized anthropic.claude-code 2.1.313 loader
author: Adverse Trace
date: 2026-10-30
references:

  - https://www.stepsecurity.io/blog/claude-code-extension-trojanized
logsource:
  category: process_creation
  product: windows
detection:
  selection_task:
    CommandLine|contains: 'SysMon'
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: 'SysMon'
  condition: selection_task or selection_schtasks
falsepositives:

  - Legitimate scheduled tasks named SysMon (verify parent process and path)
level: high

The YARA rule keys on the loader's distinctive artifacts (Node module imports, the svc-telemetry key comment, the SysMon task name, the beacon path and C2 IP). Tune the condition to your file-size baseline; the clean build is roughly 7 KB smaller. The Sigma rule covers the Windows scheduled-task persistence; extend it to Linux cron and macOS startup-file creation in your own rule set, since the source names those mechanisms but gives no exact path or filename.

7. Sources

• Step Security, "Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines", https://www.stepsecurity.io/blog/claude-code-extension-trojanized, 2026-10-29.
• Help Net Security, "Claude Code extension poisoned with persistent SSH backdoor", https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/, 2026-10-30.
• The Hacker News, "Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor", https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html, 2026-10.
• Dark Reading, "Devs Hit by Trojanized Claude Code Extension for Cursor", https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor, 2026-10-30.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact supply-chain compromise with a bounded but non-trivial blast radius: at most 5,000 Cursor users over an 11-hour window, but with persistence that outlives extension removal and reconnaissance that maps credential-bearing hosts for follow-on access. No CVE or CISA KEV entry applies, so severity rests on the persistence and credential-exposure potential rather than an exploitable flaw. The technical detail is single-to-few-sourced across Step Security and Phorion, so we treat the mechanism as corroborated but the atomic indicators as requiring verification before enforcement. We will monitor for follow-on use of the svc-telemetry key and the 134.209.82.225 infrastructure, and we recommend clients confirm exposure against their own extension-install records and complete credential rotation on any host that ran 2.1.313 before considering the incident closed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.