Backdoor found in Claude Code VS Code extension on Cursor Marketplace
Phorion found a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace. Cursor has removed both versions. Developers and teams who installed the extension should check their machines now, since the payload runs as soon as the extension loads.
Key points
- Affected builds: Claude Code for VS Code 2.1.312 and 2.1.313 distributed through the Cursor Marketplace.
- Cursor has removed these versions; check your installed version right away.
- The planted key comment is svc-telemetry; check the key's fingerprint too, not just the comment.
- On macOS, look for ~/Library/LaunchAgents/com.apple.sysmond.plist and the ~/.config/.smt script as persistence traces.
- Environment variable names may have been exposed; rotate any cloud or API tokens found on the machine.
- Extensions run with IDE privileges, so treat marketplace extensions as a trust boundary.
The incident involves a backdoor injected into the extension bundle of the official Claude Code extension distributed through the Cursor Marketplace. The malicious code runs as soon as Node loads the extension file, without any user action. It appends an attacker-controlled Ed25519 key to the user's authorized_keys file, opens an outbound reverse SSH tunnel, sets up persistence on macOS, Linux and Windows, and sends a host report to a remote server, including the names of environment variables that look like credentials.
On macOS, a bug limits the damage on some machines. The check for Remote Login runs without administrator rights, gets an error message instead of a status, and the script wrongly assumes SSH is already on, so it never enables it. The planted keys and persistence still remain. Anyone who used affected builds should treat the machine as compromised, look for the planted key and LaunchAgent, and rotate exposed credentials.
Real-world use
- Auditing extension inventory and versions across a team using Cursor with Claude Code
- Hunting for persistence traces such as planted SSH keys and LaunchAgents on developer laptops with EDR
- Pinning extension versions and verifying marketplace packages before rolling them out to a team
Why it matters
AI coding extensions run with your editor's permissions and can reach your files, source code and credentials. This incident shows that installing an extension is also a supply-chain risk, even when it carries an official name.