The Claude Code extension backdoor in 2.1.313 planted an SSH key and a reverse tunnel

Cursor has removed the release from its marketplace. According to Phorion, the NPM and VS Code versions for 2.1.313 were also pulled from their registries. Commenters on Hacker News pointed out that taking the release down does not clean machines that already loaded it. Extensions run with the permissions of the IDE and of the user running it. That gives this payload immediate access to local files, source code and developer tooling as soon as its module loads.

The compromised extension.js begins with an immediately invoked function expression that was prepended to the otherwise normal minified bundle. The rest of the bundle still contains Claude Code and VS Code strings, the usual activate and deactivate exports, and UI code. The injected prefix loads child_process, fs, os, path, http and crypto, and it executes as soon as Node loads the file. That happens before the extension's activate callback, so the user does not need to interact with the extension for the payload to fire.

The first stage creates ~/.ssh if it is missing and appends an attacker Ed25519 public key with the comment svc-telemetry to ~/.ssh/authorized_keys. It sets the directory to 0700 and the file to 0600. The script checks only for the comment string, not the key itself, so Phorion recommends hunting by public-key fingerprint rather than by the comment alone.

The same stage then tries to make the local SSH daemon listen. On Linux it tries to start sshd or ssh with systemctl, then falls back to service and /etc/init.d/. On macOS it checks Remote Login and, if the result reads Off, runs sudo -n systemsetup -setremotelogin on. On Windows it tries to install and start OpenSSH Server through PowerShell. None of these paths includes a privilege escalation exploit, and Phorion notes that the Windows path routes the PowerShell command through a helper that hardcodes /bin/sh, which will not work on a standard Windows install.

The macOS branch reads the current state with systemsetup -getremotelogin, without sudo. It attempts enablement only if the output matches /Off/i. For a standard user, systemsetup prints "You need administrator access to run this tool... exiting!" to stdout and exits with status 0. That output does not contain Off, so the script skips the enable step and treats a permission error as if SSH were already on.

On a Mac where Remote Login was off, the tunnel still connects out, but forwarded traffic reaches a closed port 22. Phorion warns against treating this as a defence. If Remote Login was already enabled, or is turned on later, the planted key works. Because the enable command often never runs, alerting that requires systemsetup -setremotelogin on will miss this campaign.

The second stage connects out over SSH to 134.209.82[.]225 on port 22 as the user tunnel. It authenticates with a second embedded private key, an unencrypted Ed25519 key with the comment svc-telemetry-tun. That key is written to the OS temp directory as .stk_ followed by the first ten hex characters of an MD5 hash of the hostname plus the home path. The tunnel uses -R *:0:localhost:22, so the attacker's server allocates a port that forwards back to the victim's sshd. The operator then logs in through that port with the svc-telemetry key and gets a full shell and file transfer, with no custom C2 code in the JavaScript.

The SSH options disable host-key checking and ignore known_hosts. They also set BatchMode, IdentitiesOnly, ExitOnForwardFailure and 30-second keepalives with ServerAliveCountMax=3. The script prefers autossh and falls back to ssh. It wraps the connection in a detached loop that sleeps 60 seconds between attempts and uses pgrep on Unix to avoid duplicate tunnels, so the tunnel survives closing the IDE.

About 1.5 seconds after setup, a one-off JSON beacon goes by plain HTTP POST to /beacon on 134.209.82[.]225:8099, with a copy to 127.0.0.1:8099. Phorion says the reason for the localhost copy is not clear from the sample, because the script sets up no listener on that port. The beacon carries:

On macOS and Linux the script writes ~/.config/.smt, a shell script that recreates the tunnel key at ~/.config/.smtk and loops the connection. On macOS a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist runs that script with RunAtLoad and KeepAlive set to true. On Linux an @reboot crontab entry runs it. Phorion notes a bug in the crontab check that can wipe a user's existing cron jobs on repeat runs, but the retrieved advisory text ends before that detail.

On Windows the script writes ~/.config/smt.cmd and ~/.config/smtk. It tries to create a scheduled task named SysMon that runs as SYSTEM at startup, which needs admin rights. If that fails, it drops sysmon.cmd into the user's Startup folder, and that file runs as the user at login.

Much of the Hacker News discussion asks whether only Cursor users were exposed. Phorion and the doublepulsar.com headline both name the Cursor Marketplace, and commenters point out that Cursor uses the Open VSX registry. One commenter relayed a report that the malicious 2.1.313 was published to Open VSX on Oct. 30. The same report says researchers filed a threat report about the same version on Microsoft's VS Code Marketplace as a precaution.

Another commenter concluded that 2.1.313 appears never to have been published on the Microsoft registry, while Phorion says the VS Code version was pulled. Phorion also says the NPM release of 2.1.313 was pulled, but it does not say whether that package was malicious. The sources do not settle whether a malicious build was ever downloadable outside Open VSX. Checking the installed version is safer than assuming you are safe because of which editor you use.

Commenters also noted that the anthropics/claude-code GitHub repo has tags for 2.1.312 and 2.1.314 but none for 2.1.313, and that the CHANGELOG skips it. The relayed report says the Open VSX listing belongs to an Anthropic employee's account. It is unclear whether that account or another part of the publishing process was compromised. Commenters linked a Cursor security notice, but its contents are not in the sources, and none of the sources includes a statement from Anthropic.

Start by checking the installed Claude Code for VS Code version in Cursor and in any other VS Code-based editor. If 2.1.313 was ever present, look for the artifacts below, which Phorion lists by platform. The commands are a starting point, not a vendor-supplied script.

Phorion gives no list of credentials to rotate. The beacon sent only variable names, but those names show the operator which tokens were on the host. If sshd was reachable while the tunnel was up, the planted key granted a shell that could read anything the user could, including the secret values and the user's own SSH keys. On such a host, the conservative move is to rotate every credential whose name matches that regex, along with SSH keys and Git credentials. Cleaning the files does not tell you what an operator did during an open session, and Phorion recommends incident response wherever the extension is found.