Trojanised Claude Code Extension Installed Persistent SSH Backdoor

On 29 October 2026, the official Claude Code VS Code extension, anthropic[.]claude-code, was published in version 2.1.313 with a malicious loader embedded in its extension.js bundle. The trojanised build appeared on Open-VSX and was mirrored by Cursor’s extension marketplace, with Cursor stating that at most about 5,000 users received the compromised copy during an 11‑hour window.

StepSecurity confirmed the payload’s behaviour through sandbox analysis and independent registry checks, reporting that on load the extension planted an attacker SSH key, installed per‑OS persistence, opened a reverse SSH tunnel to attacker infrastructure, and beaconed host reconnaissance over plain HTTP. The malicious loader is contained within a self‑contained, ~7 KB oversized extension.js, and operates without invoking Claude APIs or VS Code package‑manager lifecycle hooks.

Cursor later removed the version and fully took its marketplace offline; Open-VSX and the Microsoft Marketplace listings were concordantly updated, with 2.1.313 purged from Open-VSX API responses and content CDN, and the C2 at 134.209.82[.]225 taken offline in cooperation with the hosting provider.

Independent testing showed clean 2.1.312 (27 October) and 2.1.314 (30 October) builds, while 2.1.313’s indicators of compromise included a loopback beacon to 127.0.0[.]1:8099, a reverse SSH tunnel to 134.209.82[.]225, a dropped SSH key with the svc-telemetry comment, and modified authorized_keys. Remediation steps outlined by Cursor and StepSecurity include removing persistence, rotating credentials, and reinstalling 2.1.314 or later. Cursor notes additional remediation scripts for macOS and Windows.