Technical Advisory: Trojanized Claude Code VS Code Extension – anthropic.claude-code 2.1.313

Disclosed: October 29, 2026
Severity: Critical – Supply Chain Compromise, Persistent SSH Backdoor
Package/Component: Anthropic.claude-code VS Code extension (VSIX), distributed via Cursor Extension Marketplace
CVEs: None assigned

Executive Summary

What Happened: The Anthropic Claude Code extension for VS Code was trojanized at version 2.1.313 and distributed through the Cursor Extension Marketplace for approximately 11 hours on October 29, 2026, between 2:27am and 1:35pm PT (per the Cursor vendor advisory). The compromised build injected a 66-line function into the extension’s JavaScript bundle that fires automatically when the IDE loads the extension – before any user interaction. It plants an attacker-controlled SSH public key, opens a reverse SSH tunnel to an external server, installs platform-specific persistence, and sends host reconnaissance data including credential-bearing environment variable names. Cursor estimates up to 5,000 users were affected during the exposure window (per the Cursor vendor advisory). The clean rebuild 2.1.314 is available (per the Cursor advisory and npm registry), but installing it does not remove artifacts already planted by 2.1.313.

Why It Matters:

• Silent, automatic compromise: The backdoor fires on extension load with no user action required. Developers who had auto-updates enabled were compromised without any visible indication.
• Developer machines carry high-value credentials: SSH keys, AWS and GCP credentials, API tokens, and CI/CD authenticated sessions are common on developer workstations. The malware’s beacon phase extracted credential-bearing environment variable names immediately on infection.
• Updating alone is not enough: The persistence mechanisms – LaunchAgent on macOS, cron on Linux, scheduled task on Windows – and the planted SSH key survive the update to 2.1.314. Hosts that loaded 2.1.313 need manual cleanup before they can be considered remediated.
• Agent sessions run in the same execution context as the backdoor: AI coding agents operating inside the IDE share the process space with the compromised extension. File reads and tool outputs from those sessions were accessible to any attacker who logged in through the planted key.

High-Level Risks:

• Persistent unauthorized SSH access to developer workstations via a planted Ed25519 key
• Credential exfiltration: SSH keys, cloud access keys, API tokens, and environment variable contents
• Lateral movement into production infrastructure and CI/CD pipelines from a compromised developer machine
• AI agent sessions exposed while operating inside a backdoored environment

Immediate Actions:

1. Check for 2.1.313: Scan extension directories for anthropic.claude-code-2.1.313 on all Cursor-using developer workstations.
2. Kill backdoor processes: Terminate SSH/autossh processes using identity files from $TMPDIR/.stk_* or ~/.config/.smtk, and stop the background retry shell loop.
3. Remove persistence: Unload and delete com.apple.sysmond.plist (macOS); remove the @reboot cron entry (Linux); delete the SysMon scheduled task (Windows). Delete ~/.config/.smt, ~/.config/.smtk, and temp key files on all platforms.
4. Remove the planted SSH key: Delete the line containing svc-telemetry from ~/.ssh/authorized_keys after backing up the file.
5. Rotate all exposed credentials: SSH keys, AWS/GCP access keys, and any environment variable matching KEY|TOKEN|SECRET|PASS|AWS|GCP should be treated as exposed.

Overview

On October 29, 2026, the Anthropic Claude Code extension for VS Code – Anthropic.claude-code – was delivered to Cursor users in a trojanized state at version 2.1.313. The compromised VSIX build was available through the Cursor Extension Marketplace for approximately 11 hours (per the Cursor vendor advisory), during which users with auto-updates enabled received the malicious build automatically.

The attack targeted the packaged extension build rather than Anthropic’s source code. The @anthropic-ai/claude-code npm package is not confirmed to have been trojanized – the registry version list jumps from 2.1.312 to 2.1.314 (per the npm registry API), but a version gap does not establish that the npm package was malicious. The confirmed compromised artifact is the VSIX build distributed through the Cursor Extension Marketplace. Microsoft’s Visual Studio Marketplace did not carry the compromised build.

The attacker’s server at 134.209.82.225 was taken offline by its hosting provider after the incident was disclosed. New tunnel connections from previously compromised hosts will fail to reach the attacker. The planted SSH key, persistence mechanisms, and retry loops remain active on any host that has not been manually remediated.

Risk Analysis

1. Trust channel exploitation: The compromised build was distributed through an official marketplace under the Anthropic publisher identifier. Neither users nor standard dependency scanning tools had a ready way to distinguish the trojanized build from a routine update. The attack required only that the user had automatic extension updates enabled.

2. Zero-interaction execution: The injected code is an immediately-invoked function expression placed at the start of the extension bundle. It executes when the IDE loads the module – before the extension’s activate callback, before any command runs, before any user does anything. An IDE restart after installing 2.1.313 is sufficient to trigger the full payload.

3. Persistence that outlives the extension update: The backdoor registers itself as a system-level service on all three platforms: a macOS LaunchAgent with RunAtLoad and KeepAlive, a Linux cron @reboot entry, and a Windows scheduled task. These survive the extension being updated or uninstalled. Updating to 2.1.314 removes the malicious extension binary; it does nothing about the LaunchAgent, cron entry, or scheduled task already in place.

4. Agentic AI exposure: AI coding agents run as VS Code extensions with the full permission set of the IDE process. An agent running inside a Cursor instance that loaded 2.1.313 operated in the same execution context as the backdoor. File reads, tool call outputs, and any credentials accessed during a session were all reachable by an attacker with an active shell through the planted key.

Technical Details

The injected payload is a 66-line immediately-invoked function expression inserted at the start of the legitimate extension.js bundle. It runs on module load and executes the following steps in sequence.

SSH key planting: Checks ~/.ssh/authorized_keys for the string svc-telemetry. If not present, appends the attacker’s Ed25519 public key:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry

Private key and script setup: Writes a private key to $TMPDIR/.stk_<10 hex chars of MD5(hostname + HOME)> and creates ~/.config/.smt (the persistence shell script) and ~/.config/.smtk (the recreated tunnel key).

Platform-specific persistence:

• macOS: Installs ~/Library/LaunchAgents/com.apple.sysmond.plist with RunAtLoad and KeepAlive set to true, executing /bin/sh ~/.config/.smt. The label com.apple.sysmond mimics Apple system service naming.
• Linux: Adds a @reboot cron entry running the persistence script.
• Windows: Creates a scheduled task named SysMon and a startup folder script at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd.

Reverse SSH tunnel: Launches ssh (or falls back to autossh) with -R '*:0:localhost:22' connecting to 134.209.82.225:22 as user tunnel, using the embedded private key. A background shell loop retries the connection every 60 seconds.

Host reconnaissance beacon: POSTs a JSON payload to 134.209.82.225:8099/beacon containing hostname, username, OS type, Git user email, public IP (queried from ifconfig.me or api.ipify.org), and the names of all environment variables matching /KEY|TOKEN|SECRET|PASS|AWS|GCP/i.

macOS SSH access note: The malware includes logic attempting to enable the SSH server via systemsetup -setremotelogin on, but this requires admin privileges. On systems where SSH is not already running and the user lacks admin access, the reverse tunnel and planted key are still in place – but inbound connections will not succeed unless SSH is later enabled.

Affected Versions

Compromised artifact: Anthropic.claude-code VS Code extension (VSIX), version 2.1.313, distributed via the Cursor Extension Marketplace.

Artifact	Channel	Compromised version	Clean rebuild	Notes
Anthropic.claude-code (VS Code extension VSIX)	Cursor Extension Marketplace	2.1.313	2.1.314 (per Cursor advisory / npm registry)	darwin-arm64 and win32-x64 VSIX builds confirmed compromised. Installing 2.1.314 does not remove a backdoor already planted by 2.1.313.

Note on the npm package: @anthropic-ai/claude-code@2.1.313 is absent from the npm registry (version list jumps from 2.1.312 to 2.1.314, per the npm registry API). A registry gap does not establish that the npm package was trojanized. The npm package is not a confirmed malicious artifact and is not used as a detection signal in this advisory.

Verified file hashes (compromised builds):

Build	SHA-256	MD5
darwin-arm64 VSIX	432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62	da5469c4221775e9fe2e413e59ca7fd9
win32-x64 VSIX	3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081	bd3b71ddf3d0cc3af76249afd2c0eda1
Backdoored extension.js	ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15	–

Severity Assessment

Critical – supply chain compromise with active payload execution. No CVE assigned.

This is a supply chain attack with a malicious payload that ran automatically on victim machines. The Critical severity follows the natural range for this scenario shape: supply chain attack with active payload execution.

Attack path:

1. Auto-update delivers 2.1.313 VSIX from the Cursor Extension Marketplace
2. IDE loads extension.js; injected IIFE fires before the activate callback
3. Ed25519 public key appended to ~/.ssh/authorized_keys (comment: svc-telemetry)
4. Tunnel private key written to $TMPDIR/.stk_<10 hex chars>; persistence script to ~/.config/.smt
5. Platform persistence registered (LaunchAgent / cron / scheduled task)
6. Reverse SSH tunnel opened to 134.209.82.225:22 (user: tunnel, -R '*:0:localhost:22')
7. Host recon POSTed to 134.209.82.225:8099/beacon

Impact:

• Confidentiality: Credential-bearing environment variable names captured on first infection; full filesystem and credential access via SSH session if the tunnel connected
• Integrity: Attacker shell access enables modification of source code, CI/CD configuration, and commit history
• Persistence: Survives IDE uninstallation, extension update, and OS reboot until manually removed

Indicators of Compromise

String patterns

Indicator	Where it appears	Significance
svc-telemetry	~/.ssh/authorized_keys	Comment on the attacker's planted Ed25519 public key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry	~/.ssh/authorized_keys	Full planted public key
com.apple.sysmond	~/Library/LaunchAgents/	macOS LaunchAgent label disguised as an Apple system service
SysMon	Windows Task Scheduler	Persistence scheduled task
anthropic.claude-code-2.1.313	Extension directories, IDE configuration, agent traces	Compromised extension identifier
-R '*:0:localhost:22'	Process arguments	SSH remote port forwarding used by the reverse tunnel

File and path indicators

Artifact	Platform	Description
~/.ssh/authorized_keys (entry with svc-telemetry)	All	Planted attacker Ed25519 public key
$TMPDIR/.stk_<10 hex chars>	All	Tunnel private key; suffix derived from MD5(hostname + HOME)
~/.config/.smt	macOS, Linux	Persistence script with embedded tunnel key
~/.config/.smtk	macOS, Linux	Recreated tunnel private key
~/Library/LaunchAgents/com.apple.sysmond.plist	macOS	User LaunchAgent with RunAtLoad and KeepAlive, executing /bin/sh ~/.config/.smt
~/.config/smt.cmd, ~/.config/smtk	Windows	Persistence batch script and tunnel private key
%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/sysmon.cmd	Windows	Startup folder fallback script
~/.[ide]/extensions/anthropic.claude-code-2.1.313-*	All	Installed compromised extension directory

Network indicators

Indicator	Type	Notes
134.209.82[.]225 TCP 22	IP / SSH	Reverse tunnel server; taken offline by hosting provider after disclosure
134.209.82[.]225:8099 POST /beacon	IP / HTTP	Host recon beacon; server taken offline

The attacker’s IP is not an ongoing detection signal. The server was taken offline after disclosure, making IP-based detection unreliable and creating false-positive risk if the IP is later reassigned.

Behavioral indicators

• An IDE extension host process (Code Helper, Cursor Helper) writing to ~/.ssh/authorized_keys – extension hosts have no legitimate reason to modify SSH authentication files
• A non-Apple process creating a com.apple.* LaunchAgent plist under ~/Library/LaunchAgents/
• ssh or autossh launched from the IDE process tree with -R '*:0:localhost:22' and an identity file from $TMPDIR/.stk_* or ~/.config/.smtk
• Inbound SSH logins from 127.0.0.1 or ::1 authenticated with the svc-telemetry key (fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk) – this indicates the attacker logged in through the reverse tunnel

Immediate Mitigation Steps

Updating to 2.1.314 replaces the compromised extension binary. It does not remove artifacts already planted on disk. The steps below are required on any host that loaded 2.1.313.

1. Determine if 2.1.313 was installed

# macOS / Linux
ls ~/.vscode/extensions/ | grep "anthropic.claude-code-2.1.313"
ls ~/.cursor/extensions/ | grep "anthropic.claude-code-2.1.313"

# Windows PowerShell
Get-ChildItem "$env:USERPROFILE\.vscode\extensions" | Where-Object { $_.Name -like "anthropic.claude-code-2.1.313*" }
Get-ChildItem "$env:USERPROFILE\.cursor\extensions" | Where-Object { $_.Name -like "anthropic.claude-code-2.1.313*" }

Check for the planted SSH key directly as a cross-check:

grep "svc-telemetry" ~/.ssh/authorized_keys

The Cursor vendor advisory provides a full platform-specific detection script that checks for the SSH key and persistence files simultaneously.

2. Kill backdoor processes

# macOS / Linux
pkill -f "\.stk_"         # tunnel private key files in temp dir
pkill -f "\.smtk"         # recreated tunnel key in ~/.config
pkill -f "\.config/\.smt" # background retry shell loop

3. Remove persistence mechanisms

macOS:

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.apple.sysmond.plist
rm ~/Library/LaunchAgents/com.apple.sysmond.plist
rm -f ~/.config/.smt ~/.config/.smtk
rm -f "$TMPDIR"/.stk_*

Linux:

crontab -e    # remove the @reboot entry referencing .smt
rm -f ~/.config/.smt ~/.config/.smtk /tmp/.stk_*

Windows (PowerShell):

schtasks /delete /tn SysMon /f
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd" -ErrorAction SilentlyContinue
Remove-Item "$env:USERPROFILE\.config\smt.cmd" -ErrorAction SilentlyContinue
Remove-Item "$env:USERPROFILE\.config\smtk" -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\.stk_*" -ErrorAction SilentlyContinue

4. Remove the planted SSH key

# Back up the file first
cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak.$(date +%Y%m%d%H%M%S)

# Remove the svc-telemetry entry
grep -v "svc-telemetry" ~/.ssh/authorized_keys > /tmp/authorized_keys_clean
mv /tmp/authorized_keys_clean ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Verify removal
grep "svc-telemetry" ~/.ssh/authorized_keys && echo "KEY STILL PRESENT" || echo "Key removed"

5. Rotate exposed credentials

From a clean machine, rotate all of the following:

• SSH private keys on the affected host
• AWS access key ID and secret access key
• GCP service account keys and anything in GOOGLE_APPLICATION_CREDENTIALS
• Any token or secret in an environment variable matching /KEY|TOKEN|SECRET|PASS|AWS|GCP/i

6. Check for attacker logins

# Linux
grep "Accepted publickey" /var/log/auth.log | grep -E "from 127\.0\.0\.1|from ::1"

# macOS
log show --last 7d --predicate 'process == "sshd"' | grep "Accepted publickey" | grep -E "127\.0\.0\.1|::1"

A login from 127.0.0.1 or ::1 authenticated with the svc-telemetry key fingerprint (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk) means the attacker accessed the machine through the tunnel. Treat that host as fully compromised and engage your incident response process.

7. Update to the clean build

Update Anthropic.claude-code to 2.1.314 through the Cursor extension marketplace. This step replaces the malicious extension binary; it does not complete the remediation on its own.

Long-Term Recommendations

Extension version controls

Implement allowlisting for IDE extensions in managed development environments. Only extension versions with verified checksums against a pre-approved manifest should load in Cursor, VS Code, or Windsurf. Disable auto-updates or gate them on checksum validation for developers with access to production systems, cloud environments, or CI/CD pipelines.

Credential exposure reduction

Store long-lived credentials in a secrets manager rather than persistent environment variables. Use short-lived tokens with automatic rotation where possible. Developer machines that carry AWS/GCP credentials, SSH keys, and CI/CD tokens present a wide blast radius for any future extension compromise.

Detection coverage for AI tool environments

Geordie detects this incident by flagging the compromised extension identifier anthropic.claude-code-2.1.313 and the backdoor’s host artifacts when they appear in agent traces. Configure a Geordie Workflow alert so that any agent report of an unapproved Claude Code extension version is routed to your security team automatically. This provides post-compromise visibility without depending on network-level signals that become stale as attacker infrastructure goes offline.

Framework Context

OWASP Top 10 for Agentic AI Systems (2026)

• ASI04:2026 Agentic Supply Chain Vulnerabilities: The malicious VSIX was distributed through a trusted marketplace channel to developer workstations running AI coding agents.
• ASI05:2026 Unexpected Code Execution (RCE): The IIFE executes on module load in the IDE’s full permission context with no user interaction required.
• ASI03:2026 Identity and Privilege Abuse: The planted SSH key establishes unauthorized persistent identity on the host; the beacon phase collected credential-bearing environment variable names before any interactive session.

MITRE ATT&CK

• T1195 Supply Chain Compromise: The attack compromised the update distribution channel for a widely-used AI coding extension.
• T1195.002 Compromise Software Supply Chain: The malicious VSIX was injected into the legitimate extension’s distribution channel.

OWASP Top 10 for LLM Applications (2025)

• LLM03:2025 Supply Chain: AI tool supply chains require security governance equivalent to software dependencies.

MITRE ATLAS

• AML.M0017 AI Model Distribution Methods: The distribution channel for the AI coding assistant was used to deliver a malicious payload.

ISO/IEC 42001 and NIST AI RMF

• ISO/IEC 42001 A.10.3 Suppliers: Vendor-distributed AI tooling requires supplier security assessment and post-market monitoring.
• NIST AI RMF GOVERN 6.1: AI tool supply chains need governance controls equivalent to those applied to other software dependencies.

Additional Considerations

Incident response

If SSH auth log review reveals inbound logins from 127.0.0.1 or ::1 authenticated with the svc-telemetry key, preserve log artifacts before cleaning the host. Review Git commit history, CI/CD audit logs, and cloud provider access logs from October 29, 2026, starting approximately 2:27am PT, for unexpected actions.

Compliance

A developer workstation compromise that exposed access to production systems or customer data may trigger incident notification obligations depending on applicable regulations. Security teams should assess whether the scope of exposure meets notification thresholds under applicable data protection rules.

Sources

#	Title	Source	Date
1	Security notice – malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace	Cursor (vendor advisory)	2026-10-30
2	Official Claude Code Extension Compromise: Security Advisory	Original research	2026-10-30
3	Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension	Unite.AI	2026-10-30
4	npm registry API – @anthropic-ai/claude-code	npm	2026-10-30

---

Advisory Status: Final advisory based on vendor disclosure and independent technical analysis. Will be updated if additional evidence of attacker logins emerges or if Cursor revises its remediation guidance.

Last Updated: October 30, 2026