Analysis Finds Persistent SSH Backdoor in Claude Code Extension Artifact

Summary

Analysis of Claude Code extension artifact version 2.1.313 found code that adds an SSH key, attempts to enable SSH, creates a reverse tunnel and installs persistence. Cursor reportedly traced the malicious extension to its Marketplace, but the analyzed artifact’s origin

Key points

The analyzed version 2.1.313 contains a 66-line malicious loader prepended to the extension bundle; it runs when the extension loads, without requiring a package-manager lifecycle hook.
The loader adds an Ed25519 key labeled svc-telemetry to authorized_keys, attempts to enable SSH, and uses an embedded key to establish a reverse SSH tunnel to 134.209.82.225.
Persistence mechanisms include a macOS LaunchAgent, a Linux cron entry, and a Windows scheduled task or Startup-folder item.
The implant collects host details, Git email, and names of selected environment variables, then sends reconnaissance data over HTTP port 8099.
The analysis found no secondary malware download in the injected stage; it identifies public-IP lookups, beacon uploads, and the SSH tunnel as its network behavior.
The article recommends checking for the listed files, key, persistence entries, and SSH processes; preserving evidence, rotating accessible credentials, and reviewing logs. It says rebuilding the host is safer than assuming cleanup restores trust.
The article says Cursor attributed the malicious extension’s origin to its Marketplace, but states the analyzed artifact’s provenance is not established and does not demonstrate compromise of an official release or distribution infrastructure.

Article Details

Attack Vectors: A compromised Claude Code extension, version 2.1.313, in the Cursor Marketplace prepends a malicious loader to extension.js; the loader runs when the extension is loaded, before legitimate initialization.
The loader appends an attacker-provided Ed25519 key to the user's ~/.ssh/authorized_keys and attempts to enable the local SSH service.
The implant establishes a reverse SSH tunnel to 134.209.82.225, forwarding connections to port 22 on the victim.
The implant installs platform-specific persistence using a macOS LaunchAgent, a Linux @reboot crontab entry, or a Windows scheduled task or Startup-folder item.
The implant collects host and account details and sends reconnaissance beacons over HTTP.
Defensive Notes: Search endpoints for the listed file paths, SSH key comment, LaunchAgent label, task name, IP address, and hashes; inspect users' authorized_keys and loaded macOS LaunchAgents.
Look for long-running ssh or autossh processes containing -R *:0:localhost:22.
If the artifact was loaded, disconnect the system and preserve forensic evidence. The article recommends blocking 134.209.82.225 on ports 22 and 8099.
After preserving evidence, remove the extension and persistence, rotate credentials accessible to the affected account from a known-clean system, and review SSH, shell, process, VS Code, authentication, and network logs for follow-on activity.
The article recommends rebuilding the host rather than assuming removal of known artifacts restores trust.

Indicators of compromise

Type	Indicator	Context
IPV4	`134[.]209[.]82[.]225`	Identified as the implant's C2 and reverse-SSH-tunnel endpoint; infrastructure ownership is unverified.
SHA256	`18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927`	Deterministic aggregate digest of the analyzed directory containing the malicious artifact.
SHA256	`7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278`	SHA-256 hash of the embedded private key used to establish the reverse SSH tunnel.
SHA256	`ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`	SHA-256 hash of the malicious extension.js file.
URL	`hxxp[:]//134[.]209[.]82[.]225:8099/beacon`	HTTP reconnaissance-beacon endpoint identified as part of the implant's C2 traffic.