KIungefiltert

· 4 min read · Auf Deutsch lesen

Tampered Claude Code extension plants an SSH backdoor

Version 2.1.313 of the Claude Code extension was tampered with and planted SSH backdoors, mainly hitting Cursor users. Uninstalling isn't enough. Here's what to check now.

securityAI

Translated from the German original with an AI language model, approved by me. Read the original

A tampered build of the Claude Code extension for VS Code-compatible editors planted a persistent SSH backdoor on developer machines. The build in question is version 2.1.313 of anthropic.claude-code. It carried Anthropic's real extension ID, but Anthropic didn't make it, as Cursor states plainly in its security notice.

Correcting my post

On X and in the WhatsApp channel I wrote that the package was found on Open VSX, the Eclipse Foundation's extension marketplace used by editors such as Cursor and Windsurf. The sources no longer agree on that point:

  • Help Net Security cites Mac security firm Phorion, which says it found the package on Open VSX. In the same article, Ax Sharma of Manifold Security disagrees and says the affected build was the official extension in Cursor's marketplace.
  • The Hacker News corrected its story. It now confirms only Cursor's marketplace and says there's no evidence for Open VSX or Microsoft's marketplace.
  • StepSecurity, on the other hand, says the version was published to Open VSX and has since been purged there, and that Cursor mirrors Open VSX.

What's certain is that Cursor's marketplace pushed the version out as a normal update. Nobody has reported a malicious version on Microsoft's Visual Studio Marketplace so far. Whether Open VSX itself was affected is still unclear, so if you get your extensions from there, check anyway.

What happened

According to Cursor, the tampered version was in its marketplace for about eleven hours on October 29, 2026, from roughly 2:27 a.m. to 1:35 p.m. PT. Reports put the number of affected users at up to 5,000. If you had auto-update turned on, you got the version without doing anything.

The Hacker News says a 66-line loader had been inserted into the extension's main file, and it ran before the legitimate code. According to the analyses, it did the following:

  • It added an outside SSH key with the comment svc-telemetry to the authorized_keys file. That file lists who can log in to the machine over SSH without a password.
  • It tried to enable SSH and opened a reverse tunnel to the attackers' server. With a reverse tunnel, your own machine opens the connection to the outside. The attackers then use it to get back in, past your firewall and router.
  • It set itself up to survive reboots: a startup item on macOS, a cron entry on Linux and a scheduled task called "SysMon" on Windows.
  • It sent details about the machine to the attackers: hostname, username, OS, directories, Git email, public IP, and the names of up to 40 environment variables that looked like credentials. According to the analyses, it did not send their values.

Cursor says enabling SSH probably failed on most macOS and Windows machines because it needs admin rights. The key and the persistence were still installed, though, and the host data still went out. If SSH was already running, the door is open. So far nobody has seen any further malware being downloaded.

How the version got into the marketplace hasn't been made public. There's no CVE number, because this wasn't a software vulnerability being exploited. Someone tampered with the supply chain.

Where things stand

Cursor took its marketplace offline for a while and removed the version. It says it also reviewed access, rotated its own keys and got the attackers' server taken down by the hosting provider. Anthropic has released version 2.1.314. One detail conflicts: Cursor's notice lists 2.1.312 as tampered too, while StepSecurity checked 2.1.312 and 2.1.314 from Open VSX and found nothing in either. If Cursor gave you 2.1.312, check that machine as well.

What you should do now

  1. Check the version. Look in your editor's extension list to see whether 2.1.313 (or, in Cursor, 2.1.312) is installed now or was before. Then update to 2.1.314.
  2. Uninstalling isn't enough. The backdoor keeps running as separate scripts. Search authorized_keys for the "svc-telemetry" entry and delete it. Also check startup items, cron jobs, scheduled tasks and outbound SSH connections.
  3. Use the cleanup scripts. Cursor provides scripts for macOS and Windows plus a list of indicators of compromise.
  4. Isolate the machine and rebuild if in doubt. If you find traces, take the machine off the network. Cursor recommends considering a rebuild.
  5. Rotate credentials. Change any keys, tokens and sessions the machine could reach, and do it from a clean device.

My take

AI coding assistants run with your permissions, inside your projects and often right next to your cloud keys. That's exactly why they're worth attacking. A trusted name on the package didn't help here, because the tampered build shipped under the real publisher ID. Auto-updates are usually a good thing, but for extensions from mirror marketplaces you should at least know where they come from. A coding extension has no business touching your SSH keys, and that's exactly what endpoint monitoring should catch.

Sources