Claude Code Extension Backdoor Planted SSH Access on Developer Machines

A trojanized anthropic.claude-code extension build put SSH access on developer machines that loaded it. StepSecurity’s investigation identifies Open-VSX version 2.1.313 and its Cursor marketplace mirror. The loader added an attacker key to authorized_keys, installed separate startup mechanisms and opened a reverse SSH tunnel. Removing the extension leaves those host artifacts in place.

Inventory installed extension versions on developer workstations, especially Cursor installations, and inspect ~/.ssh/authorized_keys or %USERPROFILE%\.ssh\authorized_keys for the comment svc-telemetry. If you find 2.1.313 or the implanted key, preserve evidence, isolate the machine, remove the persistence and rotate credentials it could reach from a clean machine. Treat Cursor marketplace installs of 2.1.312 as triage candidates too: Cursor’s security-notice listing names both versions, while StepSecurity’s analysis calls the Open-VSX 2.1.312 build clean.

One extension, several startup paths

The malicious build used the legitimate Anthropic extension identity on Open-VSX, not a lookalike publisher. Its extension.js bundle contained an added loader. StepSecurity found the file was roughly 7 KB larger than the preceding release and measured its SHA-256 as ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. The researchers loaded the module under plain Node.js and observed the behavior without an IDE API call or a Claude conversation. As StepSecurity put it, “loading the extension module is enough.” The researchers say Anthropic did not develop the malicious build; the route by which it entered the registry remains under investigation. Check the installed build rather than assuming that a familiar publisher name means familiar code.

The loader planted a public key with comment svc-telemetry in the user’s SSH authorized_keys; StepSecurity records its fingerprint as SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. It also wrote a tunnel identity key as .stk_<10 hex> and sent host reconnaissance to hxxp://134[.]209[.]82[.]225:8099/beacon. That address was also the reverse-tunnel destination on TCP 22. A local beacon attempt to loopback port 8099 was observed as well. The source identifies ifconfig.me and api.ipify.org as legitimate public-IP services; traffic to either alone is a poor compromise signal.

StepSecurity observed persistence on each operating system: a cron @reboot entry on Linux, ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, and a SysMon scheduled task or Startup\sysmon.cmd on Windows. Look as well for ~/.config/.smt, ~/.config/.smtk, ~/.config/smt.cmd, %USERPROFILE%\.config\smt.cmd, and .stk_<10 hex> files under $TMPDIR or %TEMP%. The dropped Windows script has SHA-256 22f682d9ff55264e934d0f43fcfbb46d58be5cfb8fe1b3a7cbb38fe089c818b0; the tunnel-key file has SHA-256 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278.

The mirror widens the version check

StepSecurity dates exposure of 2.1.313 from October 29 at about 09:27 UTC to 20:35 UTC. It attributes to Cursor an upper bound of 5,000 Cursor users who received that build in the roughly 11-hour window. The count describes users who received a version, rather than confirmed SSH sessions. Cursor removed the marketplace version and took its marketplace offline at 20:35 UTC, according to the investigation; StepSecurity also reports the command server was taken offline with its hosting provider’s cooperation. Existing keys and startup entries still require host response.

The publisher and channel matter when scoping the earlier build. StepSecurity says it downloaded clean Open-VSX builds 2.1.312 and 2.1.314 and found none of the listed indicators in either. Cursor’s official blog index carries a security-notice headline naming 2.1.312 and 2.1.313 in the Cursor VS Code Extension Marketplace. The Open-VSX registry record currently lists 2.1.314 as latest, with 2.1.312 listed and 2.1.313 absent from its version map. Scope Cursor’s 2.1.312 installations for investigation under Cursor’s notice, and prioritize any 2.1.313 installation or implant evidence for incident response. Keep the clean Open-VSX 2.1.312 finding tied to that channel; verify provenance for Cursor-delivered copies.

Check the host before reinstalling

Start with extension inventory and the SSH key. On macOS or Linux, a safe read-only check is grep -n 'svc-telemetry' "$HOME/.ssh/authorized_keys"; on Windows, inspect %USERPROFILE%\.ssh\authorized_keys. In installed anthropic.claude-code-2.1.313-* directories, search extension.js for the strings svc-telemetry and 134[.]209[.]82[.]225 (use the canonical IP without brackets in the local file search). StepSecurity lists SHA-256 fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 for the macOS ARM64 VSIX and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 for the Windows x64 VSIX. Compare hashes only for the matching platform and file type.

If the build or key is found, collect the extension file, key entry, startup items and SSH, process, shell and authentication logs before cleanup. Remove the key and the matching cron, LaunchAgent, scheduled task or Startup entry; remove the dropped files, then remove the affected extension and install 2.1.314 or later from a trusted channel. Check for an outbound connection to 134[.]209[.]82[.]225 on TCP 22 or 8099 in network telemetry. A successful tunnel means an operator could have used the implanted key for interactive access; StepSecurity advises rebuilding the host where that connection is confirmed.

Rotate source-control, CI/CD, cloud, package-registry and SSH credentials reachable from the affected machine, using a known-clean workstation. The beacon enumerated environment variable names matching KEY, TOKEN, SECRET, PASS, AWS and GCP; examine the machine’s real credential reachability rather than treating those names as proof of credential theft. Confirm the implanted key is gone, the startup object stays absent after restart, the installed extension is on a clean build and the tunnel or beacon connection does not recur. Those checks test the access path the malicious extension created, including the part uninstalling it cannot touch.