Official Claude Code extension compromise

Phorion has uncovered a supply-chain attack targeting developers using the Cursor editor: the official Claude Code for VS Code extension was backdoored on the Cursor Marketplace, with versions 2.1.312 and 2.1.313 shipping a persistent SSH backdoor capable of running on macOS, Linux, and Windows. According to Phorion's technical write-up, Cursor has since removed both affected versions from its marketplace, and an updated advisory issued 31 October 2026 confirmed that 2.1.312 was also affected — the original notice had only identified 2.1.313.

This article walks through the full infection chain, the macOS-specific bug that partially limits the attack's reach, the reverse SSH tunnel mechanism, and the concrete indicators security teams should hunt for right now. It is aimed at developers using the Cursor editor, security engineers conducting threat hunts, and any organisation whose engineers may have installed Claude Code for VS Code between the affected version window.

What shipped in Official Claude Code extension compromise

The compromised payload is an immediately invoked function expression (IIFE) prepended to the otherwise-normal minified extension.js bundle. The rest of the file retains standard Claude Code and VS Code strings, intact activate and deactivate exports, and normal UI code — making the injection difficult to spot by casual inspection. The IIFE pulls in six standard Node.js modules — child_process, fs, os, path, http, and crypto — and executes the moment Node loads the file, before the extension's activate callback runs. No user interaction is required to trigger the payload.

Because Cursor extensions run with the full permissions of the IDE and the logged-in user, the backdoor gains immediate read-write access to local files, source code repositories, and developer tooling on first load. The payload proceeds in two stages: first planting an attacker-controlled SSH public key and attempting to enable the local SSH daemon, then establishing an outbound reverse SSH tunnel to a remote server at IP address 134.209.82[.]225 on port 22.

What improved in Official Claude Code extension compromise

Phorion identified a significant bug in the macOS SSH-enablement logic that limits impact on machines where Remote Login is not already active. The script runs systemsetup -getremotelogin without administrator privileges, then tests the output against the regex /Off/i. On a standard macOS user account, that command prints "You need administrator access to run this tool… exiting!" to stdout and exits with status 0, so the regex never matches "Off" and the script skips the sudo -n systemsetup -setremotelogin on enablement step entirely.

The Windows code path carries its own bug: the helper function det() hardcodes /bin/sh as the shell, which does not exist on a standard Windows installation. None of the three platforms include a privilege escalation exploit, so enabling a system SSH service consistently requires the infected user to already hold passwordless sudo or equivalent rights.

What you gain from Official Claude Code extension compromise

If the SSH enablement steps succeed — or if Remote Login was already active on the victim machine — the attacker gains a full interactive shell and file-transfer capability without any custom command-and-control logic embedded in the JavaScript. The reverse tunnel uses -R *:0:localhost:22, which instructs the attacker's SSH server to dynamically allocate a listening port and forward traffic back through the existing tunnel to port 22 on the victim's localhost. The tunnel flag -N keeps the connection open without running a remote command, so the connection generates minimal process noise.

To authenticate outbound, the malware decodes an embedded unencrypted OpenSSH Ed25519 private key with the comment svc-telemetry-tun and writes it to the OS temporary directory with a filename beginning .stk_ followed by the first ten characters of the MD5 hash of the hostname concatenated with the home directory path. The attacker then connects through the allocated tunnel port using the planted Ed25519 public key — comment svc-telemetry — which was appended to ~/.ssh/authorized_keys in Stage 1.

How to get Official Claude Code extension compromise

Organisations should immediately audit every developer workstation for the presence of Claude Code for VS Code versions 2.1.312 or 2.1.313 installed through the Cursor Marketplace. The primary indicators of compromise are an svc-telemetry entry in ~/.ssh/authorized_keys and a .stk_-prefixed file in the OS temporary directory. Phorion advises checking the public-key fingerprint rather than relying solely on the comment string, because the comment can be changed.

```bash
# Check authorized_keys for the planted public key
grep -i "svc-telemetry" ~/.ssh/authorized_keys

Hunt for the tunnel key file in the temp directory

If either indicator is present, engage incident response, rotate all SSH keys and secrets accessible from the affected machine, review outbound connection logs for traffic to 134.209.82[.]225 on port 22, and audit any source code or credentials the compromised machine could have reached. Cursor has removed both affected versions from its marketplace; updating to a clean version alone is insufficient if an active tunnel has already been established.

What to watch after Official Claude Code extension compromise

The Cursor Marketplace incident raises a broader supply-chain concern for editors and IDEs that distribute extensions without mandatory code-signing or server-side behavioural analysis. Because extensions execute with IDE-level permissions the moment a module is loaded, a single tampered bundle can silently backdoor every machine that installs or auto-updates it. The svc-telemetry comment and .stk_ filename pattern are trivial to change in a future variant, so defenders should build detection rules around the behavioural fingerprints — SSH key appends by IDE processes, outbound SSH from editor processes, and temp-directory key writes — rather than string matches alone.

The macOS logic bug that prevented reliable SSH enablement is not a durable protection. Any developer who already had Remote Login enabled, or who enables it after infection, gives the attacker a fully working inbound access path using the key planted during the initial load. Persistence mechanisms are still installed even when the SSH enablement step fails, and the malware beacons host reconnaissance back to the operator regardless. Organisations running endpoint detection and response tooling should add rules for child processes of Cursor spawning systemsetup, systemctl, or PowerShell with SSH service commands.