Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
On October 29, 2026, a trojanized version (2.1.313) of the official Claude Code VS Code extension was published to Cursor's extension marketplace, reaching up to 5,000 Cursor users during an 11-hour window. Sandbox and registry analysis confirmed that on load it planted an attacker SSH key, set up persistence on each OS, opened a reverse SSH tunnel to attacker infrastructure, and sent host reconnaissance data over plain HTTP.
On October 29, 2026, version 2.1.313 of the Claude Code VS Code extension, anthropic.claude-code, was published to Cursor's extension marketplace carrying a malicious loader embedded in its extension.js bundle. Cursor reports that at most 5,000 of its users received the trojanized build during an 11-hour window. We verified the payload's behavior through sandbox analysis and independent registry analysis: on load, the extension planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure, and beaconed host reconnaissance over plain HTTP.
Update (October 30, 2026): Anthropic has clarified the scope of this incident. Per Felix Rieseberg of Anthropic, this was not a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which Anthropic did not build or publish. The versions on Anthropic's official channels are not affected, and this only impacts Cursor users. Anthropic has also confirmed that 2.1.313 was never published to Open-VSX, the Microsoft Visual Studio Marketplace, or any of its official hosts, and that it skipped to 2.1.314 to avoid confusion. We have corrected the sections below, which previously described Open-VSX as the origin and implied the build had been removed from the Microsoft Marketplace.
Update (October 30, 2026, 11:30 am PT): Separately, Cursor's notice identifies malicious builds of both 2.1.312 and 2.1.313 in its marketplace for Windows and macOS. The 2.1.312 build served by Open-VSX is a different artifact: we downloaded and verified it clean. Exposure therefore covers Cursor users who installed 2.1.312 or 2.1.313 from Cursor's marketplace during the window.
The malicious build is the official extension in every respect except one: extension.js carries a small self-contained loader embedded in the legitimate bundle. The malicious file (SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, 3,692,922 bytes) is roughly 7 KB larger than the preceding clean release, and sandbox telemetry shows the payload executes under plain Node.js with no VS Code APIs: loading the extension module is enough. No Claude conversation is needed, and no package-manager lifecycle hooks are involved. This was not an Anthropic release: the build repackages the official extension, and per Cursor's notice the malicious version was not developed by Anthropic.
ACTION REQUIRED if anthropic.claude-code 2.1.313, or 2.1.312 installed from Cursor's marketplace, was present on any machine between October 29, 09:27 UTC and October 30: treat it as compromised. Check ~/.ssh/authorized_keys for the svc-telemetry key below, remove the persistence artifacts, and rotate credentials reachable from that machine. Uninstalling the extension alone is not sufficient: the loader drops standalone persistence that survives removal.
Background: the extension and its distribution paths
The Claude Code VS Code extension is Anthropic's official IDE integration, with tens of millions of lifetime downloads on Open-VSX alone. Open-VSX is the open extension registry used by default or by option in VSCodium, Cursor, Windsurf, and Gitpod; it is separate from the Microsoft Visual Studio Marketplace. The tampered build appeared in Cursor's marketplace under the legitimate identifier, not a typosquat. Per Anthropic, the actor used access to Cursor's marketplace; Anthropic's systems, employee laptops, and official channels were not compromised.
Per Cursor's updated notice, exposure covers Cursor users who installed 2.1.312 or 2.1.313 from its marketplace during the window. Anthropic has confirmed 2.1.313 was never published to Open-VSX or the Microsoft Marketplace, and the 2.1.312 build served by Open-VSX is clean (verified by us): the malicious 2.1.312 exists only in Cursor's marketplace, a different artifact despite the shared version number. After the incident, Cursor replaced the malicious 2.1.312 with clean bytes: the build its marketplace serves today is clean (we downloaded and verified it post-incident), so current installs are not re-infecting.
We independently confirmed the registry state: Open-VSX now serves 2.1.312 and 2.1.314 but returns "not found" for 2.1.313 across the API and its content CDN, and the Microsoft Marketplace download endpoint returns 404 for 2.1.313 while serving both neighbors, consistent with Anthropic's statement that 2.1.313 was never published there and that the next release was numbered 2.1.314. We downloaded the 2.1.312 (October 27) and 2.1.314 (October 30) builds from Open-VSX and verified both contain none of the indicators below.
Attack flow
Oct 27, 20:26 UTC
Clean 2.1.312 published to Open-VSX
By Oct 29, ~09:27 UTC
Trojanized 2.1.313 live in Cursor's marketplace (2:27am PT, per Cursor); per Cursor's update, a malicious 2.1.312 was served in the same window
Oct 29, 09:27 to 20:35 UTC
Exposure window for 2.1.312 and 2.1.313 from Cursor's marketplace; at most 5,000 Cursor users received it (Cursor's initial figure)
Oct 29, 20:35 UTC (1:35pm PT)
Cursor removes the version and takes its marketplace fully offline; later audits find no other extensions tampered with; keys rotated
Oct 30, 01:07 UTC
Clean 2.1.314 published to Open-VSX
Oct 30
The C2 at 134.209.82.225 is taken offline with the cooperation of its hosting provider, per Cursor
Indicators of Compromise
Type
Value
Significance
Malicious version
anthropic.claude-code@2.1.313
Presence confirms exposure
C2
134.209.82.225
Reverse tunnel (TCP 22, user tunnel) and HTTP beacon (8099); now offline
Verified clean by us; the Cursor-marketplace 2.1.312 is a distinct malicious artifact
Not indicators on their own: ifconfig.me and api.ipify.org are legitimate public-IP services, and sandbox telemetry showed connections to ordinary Microsoft infrastructure; access alone does not indicate compromise.
Remediation
If 2.1.313, or 2.1.312 from Cursor's marketplace, was installed on a machine, in order:
Check for the implant: grep authorized_keys for svc-telemetry (macOS/Linux: grep svc-telemetry ~/.ssh/authorized_keys; Windows: inspect %USERPROFILE%\.ssh\authorized_keys).
Collect evidence, then remove persistence: the LaunchAgent com.apple.sysmond.plist, the SysMon scheduled task or Startup\sysmon.cmd, cron @reboot entries, and ~/.config/.smt, .smtk, smt.cmd, plus $TMPDIR/.stk_* key files. Cursor publishes remediate-macos.sh and remediate-windows.ps1 scripts for this.
Remove the extension version and reinstall 2.1.314 or later (2.1.314 supersedes both affected versions). Removing the extension alone does not remove standalone persistence.
Rotate credentials reachable from that machine: source-control tokens (GitHub, GitLab), CI/CD tokens (the beacon collected environment variable names matching KEY/TOKEN/SECRET/PASS/AWS/GCP, which reveals which credentials were present), cloud keys, SSH keys, and package registry tokens. Do this from a known-clean machine.
Hunt for follow-on: the authorized key granted interactive SSH access where the tunnel succeeded (primarily elevated-editor runs). Review SSH, shell, process, and authentication logs. If the tunnel is confirmed to have connected, rebuilding the host is safer than cleaning it.
How StepSecurity Helps
Threat Center
StepSecurity Enterprise customers can visit the Threat Center for the complete alert on this incident, including the full IOC set, affected version details, and the machines in their organization that installed anthropic.claude-code 2.1.313.
Dev Machine Guard
StepSecurity Dev Machine Guard flags anthropic.claude-code version 2.1.313 as malicious on developer machines, so machines that pulled the trojanized build during the exposure window are identified immediately rather than waiting for a user report. Identification is version-level intelligence: 2.1.312 and 2.1.314 are recognized as clean.
Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus
Binance’s initial findings pointed to a possible DevOps laptop compromise, followed by evidence of additional breaches. The incident comes amid repeated attacks on developer extensions, packages, and CLI tools. Here is what is known and how StepSecurity Dev Machine Guard helps teams inspect and control developer tooling.
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
On October 29, 2026, a trojanized version (2.1.313) of the official Claude Code VS Code extension was published to Cursor's extension marketplace, reaching up to 5,000 Cursor users during an 11-hour window. Sandbox and registry analysis confirmed that on load it planted an attacker SSH key, set up persistence on each OS, opened a reverse SSH tunnel to attacker infrastructure, and sent host reconnaissance data over plain HTTP.
GitHub Actions Native Egress Firewall vs. Harden-Runner: Five Differences That Matter
GitHub’s native egress firewall covers GitHub-hosted Linux runners. See five ways Harden-Runner goes further, from anomaly detection to build tampering
