Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
On October 29, 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, which mirrors it. Cursor reports that at most 5,000 of its users received the trojanized build during an 11-hour window. We verified the payload's behavior through sandbox analysis and independent registry analysis: on load, the extension planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure, and beaconed host reconnaissance over plain HTTP.
On October 29, 2026, version 2.1.313 of the Claude Code VS Code extension, anthropic.claude-code, was published to Open-VSX carrying a malicious loader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, which mirrors it. Cursor reports that at most 5,000 of its users received the trojanized build during an 11-hour window. We verified the payload's behavior through sandbox analysis and independent registry analysis: on load, the extension planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure, and beaconed host reconnaissance over plain HTTP.
The malicious build is the official extension in every respect except one: extension.js carries a small self-contained loader embedded in the legitimate bundle. The malicious file (SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, 3,692,922 bytes) is roughly 7 KB larger than the preceding clean release, and sandbox telemetry shows the payload executes under plain Node.js with no VS Code APIs: loading the extension module is enough. No Claude conversation is needed, and no package-manager lifecycle hooks are involved. This was not an Anthropic release: the build repackages the official extension, and per Cursor's notice the malicious version was not developed by Anthropic.
ACTION REQUIRED if anthropic.claude-code 2.1.313 was installed on any machine between October 29, 09:27 UTC and October 30: treat it as compromised. Check ~/.ssh/authorized_keys for the svc-telemetry key below, remove the persistence artifacts, and rotate credentials reachable from that machine. Uninstalling the extension alone is not sufficient: the loader drops standalone persistence that survives removal.
Background: the extension and its distribution paths
The Claude Code VS Code extension is Anthropic's official IDE integration, with tens of millions of lifetime downloads on Open-VSX alone. Open-VSX is the open extension registry used by default or by option in VSCodium, Cursor, Windsurf, and Gitpod; it is separate from the Microsoft Visual Studio Marketplace. The Anthropic namespace on Open-VSX is owned and published by an Anthropic employee and has been since 2025, so version 2.1.313 appeared under the legitimate publisher identity, not a typosquat. The malicious version was not developed or released by Anthropic, and how it entered the registry, whether through compromised publisher credentials or another mechanism, has not been publicly established.
This matters for the blast radius: one upstream publish on Open-VSX propagated automatically to every downstream consumer of the registry. Cursor's marketplace, which serves the extension via its Open-VSX mirror, exposed the malicious build to its users within the same window. Cursor states it has no evidence that other versions or the official distribution were affected, and the version is likewise no longer served by the Microsoft Marketplace.
We independently confirmed the registry state: Open-VSX now serves 2.1.312 and 2.1.314 but returns "not found" for 2.1.313 across the API and its content CDN, and the Microsoft Marketplace download endpoint returns 404 for 2.1.313 while serving both neighbors. We downloaded the clean 2.1.312 (October 27) and 2.1.314 (October 30) builds from Open-VSX and verified both contain none of the indicators below.
Attack flow
Oct 27, 20:26 UTC
Clean 2.1.312 published to Open-VSX (verified by us)
By Oct 29, ~09:27 UTC
Trojanized 2.1.313 live on Open-VSX and, via mirror sync, in Cursor's marketplace (2:27am PT, per Cursor)
Oct 29, 09:27 to 20:35 UTC
Exposure window; at most 5,000 Cursor users received it
Oct 29, 20:35 UTC (1:35pm PT)
Cursor removes the version and takes its marketplace fully offline; later audits find no other extensions tampered with; keys rotated
Oct 30, 01:07 UTC
Clean 2.1.314 published to Open-VSX (verified by us)
Oct 30
2.1.313 purged from Open-VSX and the Microsoft Marketplace listing; the C2 at 134.209.82.225 is taken offline with the cooperation of its hosting provider, per Cursor
Indicators of Compromise
Type
Value
Significance
Local beacon attempt
127.0.0.1:8099/beacon (HTTP POST, loopback)
Loopback beacon attempt by the loader
Malicious version
anthropic.claude-code@2.1.313
Presence confirms exposure; Open-VSX and Cursor channels
C2
134.209.82.225
Reverse tunnel (TCP 22, user tunnel) and HTTP beacon (8099); now offline
Not indicators on their own: ifconfig.me and api.ipify.org are legitimate public-IP services, and sandbox telemetry showed connections to ordinary Microsoft infrastructure; access alone does not indicate compromise.
Remediation
If 2.1.313 was installed on a machine, in order:
Check for the implant: grep authorized_keys for svc-telemetry (macOS/Linux: grep svc-telemetry ~/.ssh/authorized_keys; Windows: inspect %USERPROFILE%\.ssh\authorized_keys).
Collect evidence, then remove persistence: the LaunchAgent com.apple.sysmond.plist, the SysMon scheduled task or Startup\sysmon.cmd, cron @reboot entries, and ~/.config/.smt, .smtk, smt.cmd, plus $TMPDIR/.stk_* key files. Cursor publishes remediate-macos.sh and remediate-windows.ps1 scripts for this.
Remove the extension version and reinstall 2.1.314 or later. Removing the extension alone does not remove standalone persistence.
Rotate credentials reachable from that machine: source-control tokens (GitHub, GitLab), CI/CD tokens (the beacon collected environment variable names matching KEY/TOKEN/SECRET/PASS/AWS/GCP, which reveals which credentials were present), cloud keys, SSH keys, and package registry tokens. Do this from a known-clean machine.
Hunt for follow-on: the authorized key granted interactive SSH access where the tunnel succeeded (primarily elevated-editor runs). Review SSH, shell, process, and authentication logs. If the tunnel is confirmed to have connected, rebuilding the host is safer than cleaning it.
Note: Cursor has provided additional remediation steps, detection guidance, and remediation scripts in its security notice; check the Cursor blog post for the full walkthrough.
How StepSecurity Helps
Threat Center
StepSecurity Enterprise customers can visit the Threat Center for the complete alert on this incident, including the full IOC set, affected version details, and the machines in their organization that installed anthropic.claude-code 2.1.313.
Dev Machine Guard
StepSecurity Dev Machine Guard flags anthropic.claude-code version 2.1.313 as malicious on developer machines, so machines that pulled the trojanized build during the exposure window are identified immediately rather than waiting for a user report. Identification is version-level intelligence: 2.1.312 and 2.1.314 are recognized as clean.
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
On October 29, 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, which mirrors it. Cursor reports that at most 5,000 of its users received the trojanized build during an 11-hour window. We verified the payload's behavior through sandbox analysis and independent registry analysis: on load, the extension planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure, and beaconed host reconnaissance over plain HTTP.
GitHub Actions Native Egress Firewall vs. Harden-Runner: Five Differences That Matter
GitHub’s native egress firewall covers GitHub-hosted Linux runners. See five ways Harden-Runner goes further, from anomaly detection to build tampering
StepSecurity Now Inventories AI Agent Plugins in Your GitHub Repositories and on Developer Machines
Inventory the Claude Code and Codex plugins on developer machines and in your GitHub repositories: where each came from, what it bundles, whether it is enabled, and which repositories distribute it.
.png)
