# Claude Code extension (anthropic.claude-code v2.1.313) on Open VSX poisoned with persistent SSH backdoor

> A trojanized build of the Claude Code extension, version 2.1.313, was served to VS Code-compatible editors (Cursor, Windsurf, VSCodium and others) for roughly 11 hours on 2026-10-29. On load it planted an attacker SSH key, opened a persistent reverse SSH tunnel and beaconed host reconnaissance to attacker infrastructure. Up to ~5,000 Cursor users were potentially affected; no actor attribution or CVE exists.

- **Published:** 2026-10-30T11:39:17Z
- **Last reviewed:** 2026-10-30T11:39:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4821
- **ID:** TL-2026-4821
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-29 a modified build of the Anthropic Claude Code extension (anthropic.claude-code 2.1.313) was published to the Open VSX ecosystem (reporting also references the Cursor marketplace; sources differ on the exact channel) and consumed by Cursor, Windsurf, VSCodium and other VS Code-compatible editors. Per Phorion, the tampered extension.js begins with an injected immediately invoked function expression (IIFE) prepended to the minified bundle; it imports child_process, fs, os, path, http and crypto and runs synchronously as soon as Node.js loads the extension, before the legitimate extension code initializes. Exceptions are suppressed so the extension behaves normally. One secondary source describes the loader as 66 lines.

The loader appends an Ed25519 public key with comment 'svc-telemetry' (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk) to ~/.ssh/authorized_keys (a secondary source also lists C:\ProgramData\ssh\administrators_authorized_keys on Windows), attempts to enable the host SSH server (macOS: sudo -n systemsetup -setremotelogin on; Linux: systemctl probe; Windows: PowerShell OpenSSH Server capability install), and drops an embedded unencrypted Ed25519 tunnel key (comment 'svc-telemetry-tun', SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ) to a temp file .stk_<10 hex chars> and then ~/.config/.smtk. A detached script (~/.config/.smt, smt.cmd on Windows) loops every ~60 seconds running ssh (or autossh -M 0 if present) with -N -R '*:0:localhost:22' as user 'tunnel' to 134.209.82.225:22, using BatchMode, IdentitiesOnly, StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3 and ExitOnForwardFailure=yes. The tunnel survives closing the editor, giving the operator inbound SSH to the developer machine via the reverse port on the attacker server; logins arrive from localhost (127.0.0.1/::1) using the svc-telemetry key.

Persistence: macOS uses ~/Library/LaunchAgents/com.apple.sysmond.plist (RunAtLoad, KeepAlive) mimicking Apple naming; Linux uses a user crontab @reboot entry for ~/.config/.smt; Windows uses a scheduled task named 'SysMon' (requesting SYSTEM) with a fallback sysmon.cmd in the user Startup folder. A reconnaissance beacon is sent via HTTP POST to http://134.209.82.225:8099/beacon (and 127.0.0.1:8099/beacon) containing hostname, username, OS platform, architecture, home and working directories, global Git email, public IP (looked up via ifconfig.me / api.ipify.org), setup-stage flags and up to 40 environment variable NAMES (not values) matching KEY|TOKEN|SECRET|PASS|AWS|GCP. macOS exploitation was often hampered by a logic flaw: systemsetup -getremotelogin run without elevation errors out with exit status 0 and the script treats this as 'SSH already on', skipping enablement, so inbound access fails unless Remote Login was already on; the persistence, key planting and beaconing still occur.

Impact and response: Cursor reported up to ~5,000 users maximum; the malicious package was available approximately 11:27-22:35 Cyprus time (UTC+2) on 2026-10-29 and clean version 2.1.314 followed on 2026-10-30. Microsoft's Visual Studio Marketplace was reported unaffected by Help Net Security, though one secondary source says the package was pulled from all registries. The attacker server (reported by a secondary source as DigitalOcean-hosted) was taken offline. Uninstalling the extension does NOT remove the backdoor. The method by which publishing rights to the anthropic.claude-code namespace were obtained (hijacked account, stolen token, CI/CD compromise) has not been disclosed. Credit: Phorion (CEO Calum Hall) per Help Net Security and the Phorion advisory; one secondary source separately credits Paul McCarty (6mile/OpenSourceMalware). No threat actor has been attributed. Severity HIGH is the analyst's assessment, not a vendor score.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1059.003 Windows Command Shell
- T1098.004 SSH Authorized Keys
- T1543.001 Launch Agent
- T1053.003 Cron
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1021.004 SSH
- T1572 Protocol Tunneling
- T1571 Non-Standard Port
- T1071.001 Web Protocols

## Sources

- [Claude Code extension poisoned with persistent SSH backdoor - Help Net Security](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/)
- [Official Claude Code Extension Compromise: Security Advisory - Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/)
- [Trojanized Claude Code Extension 2.1.313 in Cursor Marketplace Plants SSH Backdoor - Rescana](https://www.rescana.com/post/claude-code-extension-2-1-313-cursor-marketplace-trojanized-ssh-backdoor)
- [Trojanized Claude Code Extension on Open VSX: Check Your Developers' Macs - Threat Defence](https://threatdefence.com/article/claude-code-openvsx-extension-backdoor-advisory)
- [Claude Code Extension Backdoor on Open VSX: Analysis and IOCs - TheCyberSecGuru](https://thecybersecguru.com/news/claude-code-open-vsx-ssh-backdoor-analysis/)
- [Claude Code Extension 2.1.313 SSH Backdoor: Check and Clean Cursor, VSCodium, VS Code - aicodewith](https://aicodewith.ai/en/blog/claude-code-vscode-extension-2-1-313-backdoor-check)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4821