Malicious Claude Code extensions on Cursor planted an SSH backdoor
Original title: Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor
Cursor says versions 2.1.312 and 2.1.313 were available from about 2:27 AM to 1:35 PM PDT on October 29.
Microsoft warned that trojanized Claude Code extensions on Cursor’s marketplace tried to install a persistent SSH backdoor. Packages anthropic.claude-code 2.1.312 and 2.1.313 kept normal features while injected JavaScript collected host details and names of credential-like environment variables, not their values. The loader added an Ed25519 key marked svc-telemetry and opened a reverse tunnel to 134.209.82[.]225. Anthropic said it was not compromised. Cursor reported that errors and administrator prompts blocked SSH on most macOS and Windows hosts. Removing the extension does not delete the startup entries.
Unconfirmed: Cursor says SSH access was blocked on most macOS and Windows hosts, so successful intrusion is not established.
- Visual Studio Marketplace and the Claude Code npm distribution were unaffected.
- Persistence uses a macOS LaunchAgent, a Linux crontab, or a Windows SysMon task.
- The listed beacon is hxxp://134[.]209[.]82[.]225:8099/beacon.
- Reporting variable names alone does not show that secret values were stolen.
Impact: Persistent SSH access and host reconnaissance on developer machines
| Product | Affected |
|---|---|
| Cursor anthropic.claude-code | 2.1.312 and 2.1.313 |
- 1.Identify those extension versions, isolate hosts showing the loader or backdoor, and remove artifacts apart from legitimate SSH config.
- 2.Rotate credentials or revoke sessions when exposure is indicated.
- 3.Correlate traffic to 134.209.82[.]225, the svc-telemetry key, and the named startup paths.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1098.004 SSH Authorized KeysT1021.004 Remote Services: SSHT1053.005 Scheduled TaskT1543.001 Launch Agent
- Products
- Claude Code
- Organizations
- Microsoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.82.225 | ion and uses retry loops to reconnect. Microsoft identified 134.209.82[.]225 as the configured SSH and HTTP destination. On macOS, per |
| sha256 | 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 | ry point; not a Visual Studio extension (VSIX) package hash 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 SHA256 Decoded tunnel private-key file ~/Library/LaunchAgen |
| sha256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | orary tunnel identity; pattern rather than literal filename ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 SHA256 JavaScript entry point; not a Visual Studio extensio |
| url | http://134.209.82.225:8099/beacon | .]225 IP address Configured remote SSH and HTTP destination hxxp://134[.]209[.]82[.]225:8099/beacon URL Reconnaissance endpoint; correlate with the confi |
From the original article
3 min read at gbhackers.com
Microsoft has warned that malicious Claude Code extensions distributed through Cursor’s marketplace attempted to install a persistent SSH backdoor on developer workstations. The trojanized packages, anthropic. claude-code versions 2.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.