Trojanized Claude Code Extension Plants an SSH Backdoor

The Cursor marketplace experienced a security compromise on October 29, 2026, resulting in the publication of a malicious version of the Claude Code extension under package identifier anthropic.claude-code version 2.1.313. According to opensourcemalware.com's report, the rogue build injected an unauthorized 66-line JavaScript loader ahead of the legitimate extension entry point. While the official Anthropic npm package @anthropic-ai/claude-code, Open-VSX builds, and the Microsoft Visual Studio Code release remained safe, the compromised artifact quietly established a reverse SSH tunnel back to 134.209.82.225.

Software engineers, security administrators, and DevOps personnel running modern code editors need to understand how this developer-tool intrusion operated without triggering standard package lifecycle warnings. This technical breakdown walks through the exact operational mechanics of the unauthorized loader, reviews verification commands, and documents indicators of compromise for enterprise remediation teams across macOS, Linux, and Windows platforms.

What shipped in Trojanized Claude Code Extension Plants

The rogue distribution arrived packaged under the genuine bundle name anthropic.claude-code at revision 2.1.313 within the Cursor marketplace directory. The unpacked artifact preserved the genuine binary components and mirrored normal extension functionality, but modified extension.js with a standalone immediately invoked function expression spanning lines 1 through 66. Because this function sits ahead of the legitimate extension payload, it executes immediately when the editor starts or opens its webview, without requiring the user to initiate a prompt, launch a project, or query an AI model. The script imports Node.js process, filesystem, operating system, HTTP, and crypto modules to harvest host metadata before legitimate extension code initializes.

During the initial execution phase, the script captures local environment metrics including the system hostname, current user identity, operating system architecture, home path, and active working directory. It executes git config --global user.email to harvest identity credentials and scans process environment variables, capturing the names of up to 40 keys matching strings such as KEY, TOKEN, PASS, SECRET, AWS, and GCP. The loader suppresses internal exceptions to ensure that runtime errors do not crash the editor UI, allowing normal programming operations to proceed while silently transmitting gathered reconnaissance data across outbound networks.

What improved in Trojanized Claude Code Extension Plants

The attacker structured the injected loader to alter system configurations dynamically based on the detected operating platform while maintaining standard extension execution flow. Unlike primitive attack scripts that deploy external binaries or call remote shell scripts via package lifecycle hooks, the artifact functions entirely in memory from the initial JavaScript entry point. It creates the ~/.ssh directory with mode 0700 permissions and appends an attacker-controlled Ed25519 public key labeled svc-telemetry with fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk into ~/.ssh/authorized_keys, setting file permissions strictly to mode 0600.

The persistence layer configures native system services to ensure survival across device reboots and workspace restarts. On macOS systems, the script checks Remote Login status and attempts privilege escalation using systemsetup commands before writing an autostart daemon to Library LaunchAgents under the deceptive label com.apple.sysmond.plist. Linux installations receive a reboot entry in the user crontab pointing to hidden configuration files in the .config folder, while Windows targets configure an on-start scheduled task named SysMon or write batch files directly to the system Startup folder.

What you gain from Trojanized Claude Code Extension Plants

Analyzing this incident yields critical visibility into supply-chain intrusion techniques targeting developer desktop workstations and integrated development environments. The deployment demonstrates that sophisticated threat actors increasingly bypass build-time package audits by injecting malicious code directly into marketplace distribution archives after source verification. The injected loader decodes an embedded base64 OpenSSH private key with hash 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 into a temporary file named .stk followed by an identifier derived from the local hostname. This mechanism enables direct remote tunneling without alerting typical endpoint monitoring systems.

The analysis clarifies that the core Anthropic distribution channels avoided contamination throughout the incident window. Security teams gain immediate clarity regarding exposure boundaries, as the official npm package, standard Visual Studio Code marketplace channels, and Open-VSX mirrors contained unadulterated code. Organizations can safely validate installed packages by inspecting local file hashes against official releases, searching for rogue svc-telemetry markers in SSH authorized keys, and monitoring outbound connections targeting remote server 134.209.82.225. Identifying these specific indicators enables network defenders to isolate affected endpoints rapidly without halting developer workflows.

How to get Trojanized Claude Code Extension Plants

Developers seeking safe, verified releases of the Claude Code development tooling must use the official Anthropic package registry rather than compromised third-party mirrors. The legitimate command line tool installs globally through npm, bypassing unauthorized marketplace distributions entirely. To replace untrusted versions, purge any existing installation from local IDE extension directories and execute the standard package manager update command directly in your terminal environment. Official distribution pathways guarantee that binary signatures match verified builds released directly by Anthropic engineering teams across public repositories.

claude update

npm install -g @anthropic-ai/claude-code

Once installed, developers configure model routing and execution parameters directly inside the official Claude Code command line interface. The client supports dynamic model switching during active terminal sessions, launching pinned sessions for automated workflows, and assigning persistent global defaults across developer shell profiles. These native configuration controls allow software engineers to maintain reproducible programming environments while ensuring that every command routes exclusively through authenticated Anthropic infrastructure. To switch models within an ongoing conversation, issue the model command directly in the shell prompt.

/model claude-fable-5-1

/model fable

claude --model fable

claude config set model fable

What to watch after Trojanized Claude Code Extension Plants

Security personnel should actively monitor system logs and network telemetry for connections associated with command-and-control server 134.209.82.225 across both SSH and HTTP port 8099. The malicious implant initiates outbound reconnaissance after a 1.5-second timer, querying public IP lookup services ifconfig.me and api.ipify.org before dispatching JSON payloads to both local port 8099 and the remote C2 address. Firewalls and endpoint detection platforms must flag any persistent reverse SSH connections forwarding local port 22 through remote arguments matching -N -R *:0:localhost:22, which grant attackers direct terminal access back into developer devices.

Administrative teams must audit developer machines for unauthorized persistence artifacts created during extension runtime. This verification requires inspecting ~/.ssh/authorized_keys for the svc-telemetry marker, deleting rogue LaunchAgent definitions named com.apple.sysmond.plist on macOS, removing @reboot crontab directives on Linux, and verifying Windows scheduled tasks for rogue SysMon registrations. Because the initial loader captures names of environment variables referencing cloud credentials like AWS and GCP, incident response protocols should include rotating tokens, access keys, and passwords present in the active user environment during the compromise window.