Threat reportSupply ChainTL-2026-4821

Claude Code extension (anthropic.claude-code v2.1.313) on Open VSX poisoned with persistent SSH backdoor

highACTIVE

Claude Code extension (anthropic.claude-code v2.1.313) on (TL-2026-4821) is a high-severity supply-chain compromise, first published 2026-10-30. It has no confirmed attribution, affects Anthropic Claude Code extension for VS Code-compatible editors, maps to 17 MITRE ATT&CK techniques (T1021.004, T1033, T1036.005), and is covered by 9 detection rules and 21 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
0None referenced
Techniques
17MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
21Indicators of compromise

Key facts for TL-2026-4821

Threat ID
TL-2026-4821
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development
Target regions
Global
Detection rules
9
Indicators of compromise
21

How Claude Code extension (anthropic.claude-code v2.1.313) on works

A trojanized build of the Claude Code extension, version 2.1.313, was served to VS Code-compatible editors (Cursor, Windsurf, VSCodium and others) for roughly 11 hours on 2026-10-29. On load it planted an attacker SSH key, opened a persistent reverse SSH tunnel and beaconed host reconnaissance to attacker infrastructure. Up to ~5,000 Cursor users were potentially affected; no actor attribution or CVE exists.

On 2026-10-29 a modified build of the Anthropic Claude Code extension (anthropic.claude-code 2.1.313) was published to the Open VSX ecosystem (reporting also references the Cursor marketplace; sources differ on the exact channel) and consumed by Cursor, Windsurf, VSCodium and other VS Code-compatible editors. Per Phorion, the tampered extension.js begins with an injected immediately invoked function expression (IIFE) prepended to the minified bundle; it imports child_process, fs, os, path, http and crypto and runs synchronously as soon as Node.js loads the extension, before the legitimate extension code initializes. Exceptions are suppressed so the extension behaves normally. One secondary source describes the loader as 66 lines.

The loader appends an Ed25519 public key with comment 'svc-telemetry' (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk) to ~/.ssh/authorized_keys (a secondary source also lists C:\ProgramData\ssh\administrators_authorized_keys on Windows), attempts to enable the host SSH server (macOS: sudo -n systemsetup -setremotelogin on; Linux: systemctl probe; Windows: PowerShell OpenSSH Server capability install), and drops an embedded unencrypted Ed25519 tunnel key (comment 'svc-telemetry-tun', SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ) to a temp file .stk_<10 hex chars> and then ~/.config/.smtk. A detached script (~/.config/.smt, smt.cmd on Windows) loops every ~60 seconds running ssh (or autossh -M 0 if present) with -N -R '*:0:localhost:22' as user 'tunnel' to 134.209.82.225:22, using BatchMode, IdentitiesOnly, StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3 and ExitOnForwardFailure=yes. The tunnel survives closing the editor, giving the operator inbound SSH to the developer machine via the reverse port on the attacker server; logins arrive from localhost (127.0.0.1/::1) using the svc-telemetry key.

Persistence: macOS uses ~/Library/LaunchAgents/com.apple.sysmond.plist (RunAtLoad, KeepAlive) mimicking Apple naming; Linux uses a user crontab @reboot entry for ~/.config/.smt; Windows uses a scheduled task named 'SysMon' (requesting SYSTEM) with a fallback sysmon.cmd in the user Startup folder. A reconnaissance beacon is sent via HTTP POST to http://134.209.82.225:8099/beacon (and 127.0.0.1:8099/beacon) containing hostname, username, OS platform, architecture, home and working directories, global Git email, public IP (looked up via ifconfig.me / api.ipify.org), setup-stage flags and up to 40 environment variable NAMES (not values) matching KEY|TOKEN|SECRET|PASS|AWS|GCP. macOS exploitation was often hampered by a logic flaw: systemsetup -getremotelogin run without elevation errors out with exit status 0 and the script treats this as 'SSH already on', skipping enablement, so inbound access fails unless Remote Login was already on; the persistence, key planting and beaconing still occur.

Impact and response: Cursor reported up to ~5,000 users maximum; the malicious package was available approximately 11:27-22:35 Cyprus time (UTC+2) on 2026-10-29 and clean version 2.1.314 followed on 2026-10-30. Microsoft's Visual Studio Marketplace was reported unaffected by Help Net Security, though one secondary source says the package was pulled from all registries. The attacker server (reported by a secondary source as DigitalOcean-hosted) was taken offline. Uninstalling the extension does NOT remove the backdoor. The method by which publishing rights to the anthropic.claude-code namespace were obtained (hijacked account, stolen token, CI/CD compromise) has not been disclosed. Credit: Phorion (CEO Calum Hall) per Help Net Security and the Phorion advisory; one secondary source separately credits Paul McCarty (6mile/OpenSourceMalware). No threat actor has been attributed. Severity HIGH is the analyst's assessment, not a vendor score.

MITRE ATT&CK techniques used in TL-2026-4821

Lateral Movement

T1021.004 SSH

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories

Persistence

T1053.003 Cron; T1053.005 Scheduled Task; T1098.004 SSH Authorized Keys; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1571 Non-Standard Port; T1572 Protocol Tunneling

Initial Access

T1195.002 Compromise Software Supply Chain

Affected products and versions in Claude Code extension (anthropic.claude-code v2.1.313) on

  • Anthropic — Claude Code extension for VS Code-compatible editors (anthropic.claude-code) via Open VSX / Cursor marketplace
    Vulnerable versions: 2.1.313
    Fixed in: 2.1.314
  • Anysphere / Codeium / community — Cursor, Windsurf, VSCodium and other VS Code-compatible editors installing from Open VSX
    Vulnerable versions: Any install or update of anthropic.claude-code 2.1.313
    Fixed in: Extension 2.1.314

Remediation for Claude Code extension (anthropic.claude-code v2.1.313) on

Patches

  • Update to Claude Code extension 2.1.314 or later (clean build published 2026-10-30)

Immediate actions

  • Identify hosts with anthropic.claude-code 2.1.313 installed in Cursor, Windsurf, VSCodium or other VS Code-compatible editors (e.g. cursor --list-extensions --show-versions | grep -i claude)
  • Search every ~/.ssh/authorized_keys (and C:\ProgramData\ssh\administrators_authorized_keys on Windows) for the 'svc-telemetry' key / fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
  • Check for ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist, $TMPDIR/.stk_*, @reboot crontab entries, the SysMon scheduled task and sysmon.cmd in the Startup folder
  • Terminate ssh/autossh processes using -R '*:0:localhost:22', unload the LaunchAgent, delete persistence files and the planted key
  • Block 134.209.82.225 (TCP 22 and 8099) at the perimeter and review egress logs for it
  • Review SSH logs for logins from 127.0.0.1/::1 using the svc-telemetry key
  • On compromised hosts: isolate, preserve evidence, and rotate credentials from a clean system

Workarounds

  • Uninstalling the extension is insufficient; remove the key, persistence files and tunnel processes manually
  • Disable macOS Remote Login / host SSH server where not required

Longer-term hardening

  • Pin or allowlist approved extension versions in developer environments
  • Prefer the official Visual Studio Marketplace for Anthropic's extension where the editor supports it
  • Alert on IDE helper/node processes writing to authorized_keys or creating com.apple.* LaunchAgents
  • Alert on outbound ssh/autossh with -R from developer endpoints
  • Rebuild affected developer machines from a trusted image where compromise is confirmed

Weaknesses (CWE) in Claude Code extension (anthropic.claude-code v2.1.313) on

CWE-506

Timeline of Claude Code extension (anthropic.claude-code v2.1.313) on

  • Malicious package no longer available at ~22:35 Cyprus time, an exposure window of roughly 11 hours; Cursor reports up to ~5,000 users potentially affected.
  • Trojanized anthropic.claude-code 2.1.313 becomes available to VS Code-compatible editors (~11:27 Cyprus time, UTC+2, per Rescana); exact publishing channel (Open VSX vs Cursor marketplace) differs between sources.
  • Help Net Security and several security blogs report the SSH backdoor; the method used to obtain publishing rights for the namespace remains undisclosed.
  • Phorion publishes its technical advisory on the compromised extension, including hashes, tunnel infrastructure and persistence artifacts; CEO Calum Hall describes the IIFE loader prepended to extension.js.
  • Cursor publicly announces the incident on X (~09:46 Cyprus time) and publishes checks for the svc-telemetry key and persistence files; attacker server reported offline.
  • Clean version 2.1.314 published across registries (~02:12-03:20 Cyprus time) per Rescana.

Sources cited for Claude Code extension (anthropic.claude-code v2.1.313) on

Detection coverage for TL-2026-4821

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4821 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
21 indicators of compromise · Red and above. Compare plans

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats