Backdoored official Claude Code extension on Cursor Marketplace dropped persistent SSH backdoor

What happened

Security firm Phorion says it detected a backdoor in the official Claude Code extension for VS Code as distributed on the Cursor Marketplace, the extension store for the Cursor editor. According to the advisory, which surfaced on the Hacker News front page, release 2.1.313 of the extension contained code that installs a persistent SSH backdoor on macOS, Linux and Windows. Cursor removed the release from its marketplace and also pulled the npm and VS Code versions of 2.1.313 from their registries.

The advisory points out that extensions run with the permissions of the IDE and the user, so a backdoored extension gains immediate access to local files, source code and developer tooling as soon as its module loads.

How the payload runs

Phorion found an immediately invoked function expression prepended to the minified extension.js bundle. The rest of the file looks like the genuine extension, with the expected Claude Code and VS Code strings and normal activate and deactivate exports. The injected prefix imports standard Node.js modules, among them child_process, fs, os, path, http and crypto, and executes as soon as Node loads the file, before the extension's activate callback ever runs. The user never has to interact with the extension for the payload to fire.

Stage one: an SSH key, persistence and two bugs

The payload first makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key, commented svc-telemetry, to authorized_keys, setting permissions of 0700 on the directory and 0600 on the file. The deduplication check looks for the comment string rather than the key itself, so Phorion recommends hunting by public-key fingerprint rather than relying on the comment.

The script then tries to ensure an SSH daemon is listening: on Linux it attempts systemctl with fallbacks to service and init scripts; on macOS it checks Remote Login and, if it appears off, tries to enable it through non-interactive sudo; on Windows it tries to install and start OpenSSH Server with PowerShell. Phorion stresses there is no privilege-escalation exploit, and sudo -n fails unless the user already has passwordless sudo configured, so starting a system service does not always succeed from a standard account.

Two implementation bugs blunt this stage. The Windows path sends its PowerShell command through a helper that hardcodes /bin/sh, which goes nowhere on a stock Windows install. On macOS, the script runs systemsetup -getremotelogin without elevation; as a standard user that command prints an administrator-access error and exits with status 0, so the script's check for "Off" never matches and it skips the enablement step entirely. Phorion describes the net effect as the malware reading "cannot check the setting" as "setting already on". On a Mac without Remote Login enabled, the inbound access path is broken even though the key and persistence still land, but the advisory is explicit that this is not something to rely on, since the backdoor sits ready if Remote Login was already on or gets enabled later.

Stage two: the reverse tunnel

The script next opens an outbound SSH connection to an attacker-controlled server at 134.209.82[.]225, connecting to port 22 as the tunnel user and authenticating with a second embedded key: an unencrypted Ed25519 private key commented svc-telemetry-tun. That key is written to the OS temp directory under a filename starting with .stk_ followed by the first ten characters of an MD5 hash of the hostname and home directory path.

The connection requests remote port forwarding, asking the attacker's server to allocate a listening port dynamically and relay traffic back through the tunnel to port 22 on the victim's machine. The two keys do different jobs: the authorized_keys entry lets the operator log into the victim, while the embedded private key lets the victim reach the operator's tunnel server. Phorion says the payload is built for standing interactive access and beacons host reconnaissance data back to the operator.

What organisations should do

Phorion advises organisations to review their environments immediately for Claude Code for VS Code 2.1.313 and engage incident response wherever the extension is found. One detection wrinkle on macOS: because the enablement step is skipped for standard users, the attempt to switch on Remote Login will not appear in process telemetry.

Why it matters

This compromise sits at the intersection of supply-chain trust and developer tooling: an official-sounding extension, distributed through a marketplace, executed hostile code with the full privileges of the developer before the extension even activated. Developer machines are a high-value target because they hold source code, credentials and access to build infrastructure, and the design here — persistent keys, an outbound tunnel that sidesteps inbound firewall rules, reconnaissance beacons — points at long-term access rather than a quick theft. The macOS and Windows bugs limit parts of the chain today, but the persistence still lands, and a fix to those few lines of code would close the gap. Marketplace-distributed extensions deserve the same scrutiny as any other dependency: pin versions, watch for unexpected releases, and treat IDE plugins as code that runs as you.