Report · phorion.io
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
phorion.io
Source published October 30, 2026
Summary: 2 min read
74/100
Summary
Phorion reported that version 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace was compromised with a backdoor for macOS, Linux, and Windows. Cursor removed the release and also pulled version 2.1.313 from the NPM and VS Code registries. The injected code runs when Node loads the extension bundle, before users interact with the extension, and inherits the permissions of the IDE and signed-in user. The payload adds an attacker-controlled Ed25519 key, labeled svc-telemetry, to the user’s ~/.ssh/authorized_keys file, then attempts to enable SSH and create a reverse SSH tunnel to 134.209.82[.]225. It establishes persistence through a macOS LaunchAgent, a Linux @reboot cron entry, or Windows scheduled-task and Startup-folder mechanisms. The malware also reports host details, Git email, public IP address, setup status, and up to 40 environment-variable names matching terms such as KEY, TOKEN, SECRET, AWS, or GCP; it does not collect those variables’ values. On macOS, a privilege-checking flaw can prevent the payload from enabling Remote Login when SSH was previously disabled, reducing the effectiveness of inbound access. The installed SSH key and persistence mechanisms can still remain active, and the backdoor can work if Remote Login is already enabled or enabled later. Phorion advised organizations to investigate systems that used version 2.1.313 and remove persistence artifacts, planted keys, and active tunnels.
Key Takeaways
- Phorion identified a backdoored Claude Code for VS Code 2.1.313 extension on the Cursor Marketplace, and Cursor removed the release from its marketplace, NPM, and VS Code registries.
- The payload appends an attacker-controlled SSH public key to ~/.ssh/authorized_keys and uses a reverse SSH tunnel to 134.209.82[.]225 for potential remote access.
- The malware persists through a macOS LaunchAgent, Linux cron configuration, or Windows scheduled-task and Startup-folder mechanisms.
- The payload sends host reconnaissance data to 134.209.82[.]225:8099, including environment-variable names that indicate the possible presence of credentials or cloud tokens.
- A macOS logic flaw can stop the malware from enabling SSH on systems where Remote Login is off, but it does not remove the planted key or persistence artifacts.
What the discussion said
The thread spent less time on Claude itself than on the messy boundary between Anthropic’s official extension, Cursor’s distribution path, Open VSX, and Microsoft’s VS Code marketplace. Anthropic representatives repeatedly said its systems were untouched and that only a tampered build delivered through Cursor affected users, while the official VS Code and Open VSX channels were clean. Several readers welcomed that narrow scope, but the contradictory reports, missing version history, and pulled packages made the reassurance difficult to independently verify. The security lesson landed harder than the attribution question. Commenters treated an extension that can touch source trees, credentials, and developer machines as a high-value supply-chain target, especially when AI coding agents are already granted broad access to repos and local tools. Some argued this is not uniquely an AI problem: any compromised extension can execute malicious code. Others said agentic coding tools magnify the blast radius because users routinely hand them sensitive code and powerful permissions. The prevailing mood was distrustful of marketplace governance and automatic updates, not panic about a proven compromise of Claude’s core service. Sarcastic claims that frontier AI should have caught the intrusion were dismissed as misunderstanding a malicious package upload that likely bypassed normal model-facing review entirely.
Where opinion split
The sharp dispute is who actually failed: Cursor’s marketplace or Anthropic’s release credentials and distribution process. Anthropic’s account says an attacker used Cursor marketplace access to publish an unofficial, modified extension, so official builds and Anthropic infrastructure were outside the incident. Skeptics argue that inconsistent registry evidence and the vanished version leave open the possibility that an Anthropic-controlled publishing account or broader release pipeline was compromised.
Coverage & discussions
Hacker News · phorion.io
Community discussions
Community Sentiment
Positives
- The reported exposure appears tightly contained to Cursor users, sparing developers who installed Claude Code from Anthropic’s official VS Code channel.
- Anthropic staff responded directly in the thread with a concrete distinction between official builds and the malicious marketplace copy, giving affected teams a usable initial triage boundary.
- Readers correctly frame isolated development environments and restricted secrets as practical damage control when AI agents and extensions need broad local access.
Concerns
- A backdoored coding extension can turn the trust developers place in an AI assistant into remote access to repositories, credentials, and the workstation running it.
- Conflicting claims about Cursor, Open VSX, and the Microsoft marketplace made it unnecessarily hard to tell which Claude Code installations were safe, undermining incident-response confidence.
- AI coding workflows normalize giving tools entire codebases and shell-level power, so a supply-chain compromise can expose far more than a typical editor add-on.
- Fast or privileged extension auto-updates are a dangerous default for AI developer tools, where a poisoned release can spread through active engineering environments before humans notice.
Related Articles
Anthropic hacked to deliver remote access trojan
Oct 30, 2026
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
Apr 30, 2026
Keyv and friends compromised in active Shai-Hulud supply chain attack
Aug 4, 2026
Notepad++ supply chain attack breakdown
Feb 3, 2026
Config Files That Run Code: Supply Chain Security Blindspot
Jun 8, 2026