← All posts · October 30, 2026 · By Brian Vitko

The trojanized Claude Code extension: how to check your fleet for the SSH backdoor

On October 29, from about 2:27 AM to 1:35 PM Pacific, a tampered build of the Claude Code extension for VS Code-based editors (anthropic.claude-code version 2.1.313) was served by Cursor’s extension marketplace and by Open VSX. Cursor says at most 5,000 of its users got it and that it’s contacting them directly. A clean 2.1.314 has replaced it.

If you have developers on Cursor, Windsurf, VSCodium or anything else that installs from Open VSX, it’s worth checking. Microsoft’s own marketplace wasn’t named as a source in Cursor’s notice. Coralogix notes a 2.1.313 showed up there too, but hadn’t analyzed it.

What the tampered build did

Someone slipped 66 lines into the top of the extension’s main bundle. The real Claude Code ran right after them, so from the user’s side nothing looked different. Those lines did four things:

• Added the attacker’s SSH key (comment svc-telemetry) to the user’s ~/.ssh/authorized_keys.
• Opened a reverse SSH tunnel to 134.209.82.225 that points back at the machine’s own port 22, and retried about once a minute whenever it dropped.
• Set the tunnel up to come back after a reboot. On Windows that’s a scheduled task named SysMon and a sysmon.cmd in the Startup folder, on macOS it’s a LaunchAgent named com.apple.sysmond, and on Linux it’s an @reboot line in the user’s crontab.
• Reported home to http://134.209.82.225:8099/beacon with the hostname, username, OS, Git email, working directories and public IP, plus the names of up to 40 environment variables that look like they hold secrets (anything with KEY, TOKEN, SECRET, PASS, AWS or GCP in the name).

The tunnel only exposes something if an SSH server is already listening. The extension can’t turn one on without admin rights, so most Windows laptops and Macs got the key and the tunnel but had nothing for the tunnel to reach. A Mac with Remote Login on or a Linux box running sshd is different. Treat those as compromised.

Unfortunately, the version number won’t tell you. The tampered build kept a real version number, so “is it 2.1.313” is the wrong question. Cursor’s own cleanup script decides by what’s in extension.js, and that’s the right call. Look for the svc-telemetry string, or the published SHA-256 of the bad file (ecb58cb2...6bf15).

Don’t forget the Linux servers

VS Code Remote-SSH and Cursor’s remote mode install extensions on the server the developer connects to, under ~/.vscode-server/extensions or ~/.cursor-server/extensions. Those are exactly the boxes where sshd is already running. Check them too, not just the laptops.

What to look for

Per user profile, on every platform:

• any anthropic.claude-code-* folder under ~/.<editor>/extensions whose extension.js contains svc-telemetry
• the key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry in authorized_keys (on Windows also check C:\ProgramData\ssh\administrators_authorized_keys)
• tunnel key files named .stk_ plus ten hex characters in the temp folder

Then the per-platform persistence:

One thing to watch with the key: it was appended without a leading newline, so on some machines it’s glued to the end of a real key on the same line. A grep -v svc-telemetry cleanup would delete the real key along with it. Remove the exact key text, not the line.

Cleaning it up

Cursor published cleanup scripts for macOS and Windows. They stop the tunnel, remove the persistence, delete only the tampered extension folders and take only the attacker’s key out of authorized_keys. They’re short and readable, so read them before you run them.

The macOS one has to run once as each affected user, without sudo, and the Windows one doesn’t touch C:\ProgramData\ssh\administrators_authorized_keys. Neither covers Linux, which matters for the Remote-SSH servers above.

After that:

• update the extension to 2.1.314 or later from the editor
• rotate whatever lived in that user’s environment. Only the variable names went out, but a list of exactly which secrets a developer holds is a good shopping list
• if sshd was running while the key was in place, handle it as a security incident. Someone may have logged in, so check the SSH logs for logins with that key and look at everything that account can reach

Doing it with RFF

The RFF Script Library has a check and a removal for this, for Windows, macOS and Linux. They run as SYSTEM/root and cover every user account on the machine, every VS Code-based editor, and the remote-server folders on Linux. The check is read-only and names exactly what it found. The removal follows Cursor’s steps, keeps every other key and every other cron line, and supports a dry run. On a Mac it unloads the fake com.apple.sysmond LaunchAgent first, so the tunnel can’t come back while it’s being cleaned. We tested all of them end to end on lab machines with harmless stand-in files, not the malware.

RFF is free for your first 100 endpoints: getrff.com.

Sources: Cursor’s security notice, StepSecurity, Coralogix, The Hacker News.