Trojanised Claude Code Extension Plants Persistent SSH Backdoor

Cybersecurity researchers disclosed that the official Anthropic Claude Code extension for VS Code was compromised via Cursor Marketplace, with malicious code planted in a modified Claude Code extension accessed through Cursor’s IDE extension marketplace. Cursor said the incident affected at most 5,000 users and that the malicious package identified itself as anthropic[.]claude-code version 2.1.313, but its main JavaScript bundle contained a malicious 66‑line loader inserted before the legitimate extension code.

Anthropic has since released version 2.1.314 on Open VSX and the Microsoft VS Code Marketplace. The compromised extension was designed to activate after VS Code starts and when its webview opens, adding an attacker‑controlled SSH key to the user’s ~/.ssh/authorized_keys file (labelled “svc-telemetry” to appear harmless) and then attempting to expose the host via a reverse SSH tunnel.

Evidence of the command and control path includes a beacon callback to 134.209.82[.]225:8099 over HTTP and platform‑specific persistence mechanisms (scheduled task, cron job, and LaunchAgent).

Researchers attributed the findings to the involvement of Cursor and OpenSourceMalware, noting that on some macOS and Windows hosts the extension could not enable the local SSH service due to insufficient admin rights, yet still added the SSH key, established persistence, and exfiltrated host details to the attacker. Cursor advised remediation steps for affected users, including isolating hosts, removing the unauthorized SSH key and persistence entries, and rotating credentials and sessions.

The incident followed a separate security disclosure by Cursor stating the malicious version operates across Windows, Linux and macOS environments, with the malicious payload removed as of 30 October 2026.