Trojanized Claude Code Extension 2.1.313 Planted a Persistent SSH Backdoor
Summary
StepSecurity's sandbox and registry analysis found that official Claude Code extension 2.1.313, distributed via Open-VSX and Cursor, ran a loader that installed SSH access, persistence and a reverse tunnel. Cursor said up to 5,000 users received it.
Key points
- The malicious loader was embedded in official Claude Code VS Code extension version 2.1.313, published on October 29, 2026.
- Sandbox analysis found the loader executes when the extension module loads, using plain Node.js without VS Code APIs or a Claude conversation.
- The payload planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel and sent host reconnaissance over plain HTTP.
- The build reached Open-VSX and Cursor's marketplace mirror; Cursor said up to 5,000 users received it during an approximately 11-hour exposure window.
- StepSecurity's registry checks indicated the Microsoft Marketplace listing was not affected. The malicious version was removed, and the C2 server was taken offline with hosting-provider cooperation, per Cursor.
- Uninstalling the extension alone does not remove the standalone persistence. StepSecurity advises checking for the `svc-telemetry` SSH key and persistence artifacts, removing them, and rotating reachable credentials.
- The article recommends reinstalling version 2.1.314 or later and reviewing host logs; rebuilding is safer if the reverse tunnel is confirmed to have connected.
Article Details
- Attack Vectors
- A trojanized version of the official anthropic.claude-code extension, version 2.1.313, was distributed through Open-VSX and Cursor's Open-VSX mirror. Loading the extension was sufficient to execute its embedded JavaScript loader under Node.js.
- The loader installed an attacker SSH key, created per-operating-system persistence, opened a reverse SSH tunnel to attacker infrastructure, and sent host-reconnaissance data over HTTP.
- Defensive Notes
- Treat machines that had anthropic.claude-code 2.1.313 installed during the exposure window as compromised; uninstalling the extension alone does not remove the persistence.
- Check authorized_keys for the svc-telemetry key; collect evidence, remove the listed persistence artifacts, and rotate credentials reachable from the affected machine using a known-clean machine.
- Review SSH, shell, process, and authentication logs for follow-on activity. The article says rebuilding is safer if the tunnel is confirmed to have connected.
- The article identifies versions 2.1.312 and 2.1.314 as clean and reports that 2.1.313 was removed from the registries.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]209[.]82[.]225 | C2 infrastructure used for the reverse SSH tunnel and HTTP beacon; reported offline after cooperation with its hosting provider. |
| MD5 | bd3b71ddf3d0cc3af76249afd2c0eda1 | MD5 of the malicious win32-x64 VSIX, identified by Cursor. |
| MD5 | da5469c4221775e9fe2e413e59ca7fd9 | MD5 of the malicious darwin-arm64 VSIX, identified by Cursor. |
| MD5 | f49bcd657ef1e626e85ce858958c1769 | MD5 of the malicious extension.js bundle. |
| SHA256 | 22f682d9ff55264e934d0f43fcfbb46d58be5cfb8fe1b3a7cbb38fe089c818b0 | SHA-256 of smt.cmd, identified as a dropped Windows persistence script. |
| SHA256 | 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 | SHA-256 of the malicious win32-x64 VSIX, identified by Cursor. |
| SHA256 | 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 | SHA-256 of the malicious darwin-arm64 VSIX, identified by Cursor. |
| SHA256 | 49d616941deb44840dc89061c617ad7a325aa32113819ddc14e9c8dc238c83d1 | Post-implant SHA-256 associated with the modified authorized_keys file. |
| SHA256 | 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 | SHA-256 of the dropped tunnel key file written as .stk_<id>. |
| SHA256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | SHA-256 of the malicious extension.js bundle embedded in version 2.1.313. |
| URL | hxxp[:]//134[.]209[.]82[.]225:8099/beacon | Malicious beacon endpoint receiving host-reconnaissance JSON over HTTP. |
MITRE ATT&CK
T1021.004 · SSHThe implant establishes a reverse SSH tunnel to attacker infrastructure and uses SSH access for interactive access where the tunnel connected.T1041 · Exfiltration Over C2 ChannelHost-reconnaissance JSON, including collected environment-variable names, is sent to the C2 endpoint.T1053.003 · CronThe malware creates a cron @reboot entry for persistence.T1053.005 · Scheduled TaskOn Windows, the malware creates the SysMon scheduled task configured to run at startup.T1059.007 · JavaScriptThe malicious JavaScript loader executes under plain Node.js when the extension module is loaded.T1071.001 · Web ProtocolsThe implant sends host-reconnaissance beacon data to the C2 over HTTP.T1098.004 · SSH Authorized KeysThe loader adds an attacker SSH key to authorized_keys to enable interactive access.T1543.001 · Launch AgentOn macOS, the malware installs the com.apple.sysmond LaunchAgent for persistence.T1547.001 · Registry Run Keys / Startup FolderThe malware uses the Windows Startup folder path Startup\sysmon.cmd for persistence.
Vendors
AnthropicOn October 29, 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. The version was distributed throughCursorloader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, which mirrors it. Cursor reports that at most 5,000 of its users received the
Products
Claude CodeOn October 29, 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. The version was distributed throughCursorloader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, which mirrors it. Cursor reports that at most 5,000 of its users received theOpenVSXwith a malicious loader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, which mirrors it. Cursor reports that at most 5,000 of itsVS CodeOn October 29, 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. The version was distributed through