Claude Code extension on Cursor Marketplace carried an SSH backdoor, Phorion says

Security firm Phorion says it has found a compromise of the official Claude Code for VS Code extension on the Cursor Marketplace. The extension bundle contains a persistent Secure Shell (SSH) backdoor. Cursor has removed the affected versions, 2.1.312 and 2.1.313, from its marketplace. An update dated 31 October 2026 says Cursor's security notice now lists both versions, distributed through the Cursor Marketplace for macOS and Windows, as affected; the advisory had earlier named only 2.1.313. Phorion tells organisations to review their environments at once for use of either version and to engage incident response wherever the extension turns up.

The implant has setup and persistence logic for macOS, Linux and Windows. Phorion's write-up concentrates on macOS and points out implementation bugs on the other platforms. The malicious code is an immediately invoked function expression prepended to the minified extension.js. The rest of the bundle looks like the normal extension, with Claude Code and VS Code strings, ordinary activate and deactivate exports, and UI code. The prefix loads standard Node.js modules (child_process, fs, os, path, http, crypto) and runs as soon as Node loads the file, before the extension's activate callback. The user does not need to interact with the extension for it to fire. Phorion notes that extensions run with the permissions of the IDE and its user, so a backdoored one gets immediate access to local files, source code and developer tooling.

Stage 1 prepares SSH access. The payload makes sure ~/.ssh exists and appends an attacker's Ed25519 public key, with the comment svc-telemetry, to ~/.ssh/authorized_keys, setting 0700 on the directory and 0600 on the file. Before appending it checks whether the string svc-telemetry is already in the file, not whether the key is, so Phorion advises hunting by public-key fingerprint rather than by comment alone. It then tries to get an SSH daemon running. On Linux it tries systemctl, falling back to service and /etc/init.d/. On macOS it checks Remote Login and, if it reports Off, tries sudo -n systemsetup -setremotelogin on. On Windows it tries to install and start OpenSSH Server through PowerShell. None of this includes a privilege escalation exploit, and non-interactive sudo -n fails unless the user already has passwordless sudo.

Phorion calls out a likely bug in the macOS logic. The script runs systemsetup -getremotelogin without elevation. As a standard user, that command prints "You need administrator access to run this tool... exiting!" to stdout and exits with status 0. The script only tries to enable SSH if the output matches /Off/i, so it skips the enablement step and effectively treats "I can't check" as "already on". On a Mac without SSH already running, the inbound path breaks: the outbound tunnel can still connect, but traffic sent back through it reaches a closed port 22 on localhost. The SSH keys and persistence are still dropped, and Phorion stresses this is no defence: if Remote Login is already on, or is turned on later, the backdoor is ready. The Windows path has its own apparent bug: it passes the PowerShell setup command through a helper, det(), that hardcodes /bin/sh.

Stage 2 opens a reverse SSH tunnel. The script connects outbound to 134.209.82[.]225 (defanged in the source) as the tunnel user on port 22, authenticating with a second embedded key, an unencrypted OpenSSH Ed25519 private key with the comment svc-telemetry-tun. The first key lets the attacker log into the victim; the second lets the victim connect out to the attacker's server. The tunnel key is written to the temp directory in a file named .stk_ plus the first ten characters of an MD5 hash of the hostname and home directory path. The tunnel uses -R *:0:localhost:22, which asks the attacker's server to allocate a listening port dynamically and forward traffic on it back to the victim's SSH on port 22. With -N the tunnel runs no remote command; the operator simply opens a separate SSH session through the allocated port and logs in with the planted key, getting an interactive shell and file transfer without any custom command handling in the JavaScript. The command disables host-key checking, ignores known_hosts, enables BatchMode and IdentitiesOnly, sets keepalives to 30 seconds (ServerAliveCountMax=3) and turns on ExitOnForwardFailure. It uses autossh if present, otherwise ssh, inside a detached retry loop that sleeps 60 seconds between attempts and uses pgrep on Unix to avoid duplicate initial tunnels. Because the loop is detached, the tunnel stays up after the user closes the IDE.

Stage 3 provides persistence. On macOS and Linux, a ~/.config/.smt script embeds the tunnel private key and writes it to ~/.config/.smtk before starting the reconnection loop. On macOS a LaunchAgent disguised as com.apple.sysmond.plist in ~/Library/LaunchAgents/ is set to RunAtLoad and KeepAlive.

Stage 4 is host reconnaissance. The script sends a one-off beacon containing hostname, username, OS platform and architecture, home directory, current working directory, the global Git email, the public IP address (looked up via ifconfig[.]me, falling back to api[.]ipify[.]org), status flags from each setup stage, and up to 40 environment variable names (names only, not values) matching /KEY|TOKEN|SECRET|PASS|AWS|GCP/i. Phorion says this gives the operator an inventory of which hosts hold cloud credentials or API tokens, though the secret values themselves are not sent. The JSON goes by plaintext HTTP POST to /beacon on both 134.209.82[.]225:8099 and 127.0.0.1:8099. Why a copy goes to localhost is unclear from the sample, since the script sets up no local listener on that port. Phorion concludes that the payload aims at long-term interactive access, and that although the macOS bug limits impact there, the malware remains a significant threat.

Key facts

Phorion reports that Claude Code for VS Code versions 2.1.312 and 2.1.313 on the Cursor Marketplace carried an injected SSH backdoor; Cursor has removed both versions.
The injected code runs as soon as Node loads extension.js, before the extension's activate callback, with no user interaction needed.
It plants an Ed25519 key (comment svc-telemetry) in authorized_keys, opens a reverse SSH tunnel to 134.209.82[.]225 and persists after the IDE closes, via a macOS LaunchAgent disguised as com.apple.sysmond.plist.
A beacon sends host details and up to 40 secret-like environment variable names (not values) over plaintext HTTP to port 8099.
A macOS bug (systemsetup -getremotelogin exits 0 with an error message) can stop the script enabling SSH on Macs where Remote Login is off, but Phorion says this is no defence.

Why it matters

This is a backdoor inside a widely recognised official extension, not a lookalike. Because extensions run with the permissions of the IDE and the user, a backdoored one reaches local files, source code and developer tooling the moment its module loads. Here the payload fires on load, before activate, so no click is needed. Its goal, in Phorion's words, is long-term interactive access: a planted SSH key, a reverse tunnel that outlives the editor, and a beacon that tells the operator which machines hold cloud credentials or API tokens.

Who it affects

Anyone who installed Claude Code for VS Code version 2.1.312 or 2.1.313 from the Cursor Marketplace. Cursor's security notice, as cited by Phorion, lists macOS and Windows as affected platforms, though the implant itself carries setup logic for macOS, Linux and Windows. Developers with cloud keys or API tokens in their environment are the stated target of the reconnaissance step. Phorion directs organisations to check their fleets for these two versions.

How to use it

This is a defender's checklist, not a tool. Phorion's advice: review environments at once for Claude Code for VSCode 2.1.312 or 2.1.313 and engage incident response where either is found. Indicators described in the visible write-up: an authorized_keys entry carrying the comment svc-telemetry (match on the public-key fingerprint, not just the comment); a temp-directory file starting with .stk_; ~/.config/.smt and ~/.config/.smtk; a LaunchAgent named com.apple.sysmond.plist in ~/Library/LaunchAgents/; outbound SSH to 134.209.82[.]225 on port 22; and plaintext HTTP POSTs to /beacon on port 8099. Phorion notes that you will not see a Remote Login enablement attempt in process telemetry when the extension runs as a normal user. The source text is truncated, so any indicator list, detection guidance and remediation steps that follow are not visible here.

How solid is it

The detail is high: the write-up includes code excerpts, key comments, file names and network endpoints, and Cursor has removed the versions and issued a security notice that Phorion cites. The account comes from Phorion, the firm that found the issue, and the visible text is cut off mid-article. Some points are hedged by the authors themselves: the Windows bug is described with "it looks like", and the macOS SSH check is called a "likely oversight".

Risks and caveats

The visible text does not say how the extension bundle was compromised (publisher account takeover, build pipeline, or otherwise) or who uploaded it. It does not say whether the Claude Code extension on the Visual Studio Code Marketplace or Anthropic's own distribution is affected, nor give any Anthropic statement. The attacker is not named. No number of affected users, installs or confirmed victims is given, nor any date or duration for when the malicious versions were available. The beacon sends environment variable names only, and the visible text does not say that secret values or source code were exfiltrated. The affected-version list already changed once: the advisory first named only 2.1.313 and was updated on 31 October 2026 to add 2.1.312. The macOS bug is not a safeguard: a Mac with Remote Login already on, or turned on later, leaves the backdoor usable.

“You need administrator access to run this tool... exiting!”

— macOS systemsetup output when run as a standard user, as quoted by Phorion