Poisoned Claude Code extension on Open VSX planted an SSH backdoor
Original title: Claude Code extension poisoned with persistent SSH backdoor
Version 2.1.313 was on Cursor’s marketplace for about 11 hours; Cursor says at most 5,000 users were affected.
Phorion found that Claude Code extension version 2.1.313 on Open VSX injected code that adds an SSH key labeled svc-telemetry, opens a reverse tunnel, and persists via launch items, cron, or a scheduled task. It also beacons host details and the names of up to 40 credential-like environment variables, not their values. Microsoft’s marketplace never carried the build. Cursor said the package was not Anthropic’s, took the attacker server offline, and rebuilt its marketplace after finding no other tampered extensions. Uninstalling does not remove dropped scripts.
Unconfirmed: Cursor says SSH login was unlikely without admin rights on most Mac and Windows hosts, but later use of the backdoor is not ruled out.
- The payload runs when Node loads the file, before normal activation.
- The tunnel retries about every 60 seconds and survives editor exit.
- A faulty Remote Login check often skips enabling SSH on macOS.
- Cursor published checks for the svc-telemetry authorized-keys entry.
- Phorion suggests reviewing SSH logs for localhost logins using that key.
Impact: Persistent SSH access and an inventory of credential-like variables
| Product | Affected |
|---|---|
| Anthropic Claude Code extension | 2.1.313 |
- 1.Check SSH authorized keys for an entry labelled svc-telemetry and run the published cleanup.
- 2.Isolate affected machines, consider a rebuild, and rotate reachable credentials from a trusted system.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1098.004 SSH Authorized KeysT1021.004 SSHT1547 Boot or Logon Autostart Execution
- Vendors
- Anthropic
- Products
- Claude CodeOpen VSXCursor
- Victims
- Cursor
- Organizations
- PhorionEclipse FoundationMicrosoft
From the original article
4 min read at helpnetsecurity.com
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The malicious package, version 2. 1.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.