Claude Code Extension Compromise Exposes VS Code Users to Persistent SSH Backdoor

Claude Code Extension Compromise Exposes VS Code Users to Persistent SSH Backdoor

The Anthropic Claude Code VS Code extension was compromised to install a persistent SSH backdoor on users’ machines. The malicious build, distributed through the Cursor marketplace, added an attacker-controlled SSH key to the victim’s ~/.ssh/authorized_keys file and opened a reverse tunnel to 134.209.82.225:8099. The attack was detected and the service was temporarily removed by Cursor. Anthropic released a clean version 2.1.314 and removed the malicious build from the Open VSX registry.

Attack Path and Technical Details

The attacker’s payload was delivered as a normal VS Code extension. Once installed, the extension executed a Node.js script that performed the following steps:

1. Created a file in the user’s home directory named .ssh/authorized_keys if it did not already exist.
2. Appended a public key labeled "svc-telemetry" to that file.
3. Spawned a background process that opened a reverse SSH tunnel to the attacker’s IP address on port 8099.
4. Periodically sent system reconnaissance data (hostname, OS version, and installed extensions) back to the same IP.

The reverse tunnel allowed the attacker to maintain a foothold even after the extension was uninstalled, because the SSH key remained in the authorized_keys file. The attacker could then log in as the local user or, if the key had elevated privileges, gain higher access.

Exposure Scope and Affected Users

Cursor reported that the malicious build was distributed to approximately 5,000 users through its marketplace. The build was identified as version 2.1.313, the last release before the clean version 2.1.314 was published. Users who installed the extension between the release of 2.1.313 and the detection of the compromise were at risk. The attack did not rely on a zero-day vulnerability in VS Code itself; it leveraged the trust model of the extension marketplace.

Evidence and Detection

The evidence for the compromise came from several sources:

• Cursor’s own audit logs showed an unexpected outbound connection from the extension to 134.209.82.225 on port 8099.
• The extension’s source code, available in the open-source repository, contained a hard-coded SSH public key that was not present in earlier commits.
• Security researchers observed the reverse tunnel in network traffic captures and confirmed that the key was appended to authorized_keys.

These findings were corroborated by Anthropic’s incident response team, which confirmed the presence of the malicious code in the 2.1.313 build.

Mitigation Steps for Engineers

1. Verify the version of the Claude Code extension installed. If the version is 2.1.313 or earlier, uninstall the extension immediately.
2. Inspect the ~/.ssh/authorized_keys file for any entries labeled "svc-telemetry" or other unfamiliar keys. Remove them if found.
3. Check for any lingering background processes that maintain an SSH tunnel to 134.209.82.225:8099 and terminate them.
4. Update the extension to the latest clean release (2.1.314) or later.
5. Monitor outbound SSH connections from the machine for any unexpected destinations.

If the machine is part of a larger network, perform a network-wide scan for similar backdoors and ensure that all users have updated their extensions.

Long-Term Implications and Next Steps

This incident underscores the risk of supply-chain attacks that target legitimate extension marketplaces. Even extensions that are open source can be compromised if the build pipeline is not secured. Organizations should implement the following controls:

• Require signed extensions and verify the publisher’s identity before installation.
• Use a dedicated extension store with strict review processes.
• Monitor for anomalous outbound connections from development tools.
• Maintain an inventory of installed extensions and their versions.

Anthropic has pledged to enhance its build security and will publish a detailed post-mortem. Cursor has announced that it will review its marketplace policies and implement automated scanning for malicious code.

Related Coverage

• FortiBleed 2.0 Exposes 40,573 Secrets, PHP2Shell Scanning Continues, and 26 Other Threats Detected
• PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites

Explore More on This Topic

• More vulnerability coverage

Related coverage

• Tailscale SSH vulnerability Fixed in v1.104.4
• Magento Stores Hit by Scanner-Evasion JavaScript Loader Campaign