On 30 October the endpoint security company Phorion published an advisory about the Claude Code for VS Code extension as distributed on the Cursor Marketplace. The extension bundle for version 2.1.313, it says, “contains a persistent Secure Shell (SSH) backdoor.” The advice is short: review your environments for that version and “engage incident response where use of the extension is discovered.”
The advisory spends a good deal of space on a mistake in the malware. On macOS the code that is supposed to switch on SSH usually doesn’t, because it misreads an error message. That is real, and it does limit what the backdoor can do on a Mac. I wanted to know how much of the attack survives the bug, because that is what decides how worried someone who installed 2.1.313 should be.
What the bundle does when it loads
The malicious code is an immediately invoked function prepended to the minified extension.js. It runs “as soon as Node loads the file, before the extension’s normal activate callback even runs,” so the user does not have to open the extension or click anything. The rest of the bundle looks like the normal extension.
Phorion describes four stages. First, the payload appends an attacker’s Ed25519 public key, with the comment svc-telemetry, to ~/.ssh/authorized_keys. Second, it opens an outbound SSH connection to 134.209.82[.]225 with a remote port forward (-R *:0:localhost:22). The attacker’s server picks a port and anything sent to that port comes back through the tunnel to the victim’s own SSH daemon. The tunnel runs in a detached loop that retries every 60 seconds, so it keeps going after the editor is closed. Third, it installs persistence: a user LaunchAgent named com.apple.sysmond on macOS, an @reboot crontab entry on Linux, and on Windows a scheduled task called SysMon or, failing that, a script in the Startup folder. Fourth, 1.5 seconds after setup, it sends a one-time HTTP beacon with the hostname, username, Git email, public IP, and up to 40 environment variable names that match /KEY|TOKEN|SECRET|PASS|AWS|GCP/i.
Between stage one and stage two there is one more step. The payload tries to make sure SSH is actually listening on the victim’s machine, and that step is where the macOS bug is.
The macOS check that reads an error as “on”
On a Mac, the payload runs systemsetup -getremotelogin without elevation and checks whether the output matches /Off/i. Only if it does will it try sudo -n systemsetup -setremotelogin on. Phorion’s point is that a standard user can’t read that setting. The command prints “You need administrator access to run this tool… exiting!” to standard output and exits with status 0. The malware’s helper returns that string, it does not contain “off,” and the enable step is skipped.
In Phorion’s words, the script “effectively treats ‘I don’t have permission to check if SSH is off’ as ‘SSH is already on’.” If Remote Login was not already enabled, the tunnel still connects to the attacker’s server, but traffic forwarded back through it “will hit a closed port 22 on localhost.”
The other platforms have problems of their own. On Windows, the PowerShell command that sets up OpenSSH Server goes through a helper that hardcodes /bin/sh, which Phorion says “isn’t going to get very far on a standard Windows install.” On Linux, the code tries to enable sshd through systemctl, service or /etc/init.d/. Phorion adds that a bug in the crontab check “can wipe existing user cron jobs on repeat runs.” With a bug on each of the three platforms, the code doesn’t look like it was tested much.
What the bug doesn’t cover
None of these bugs is a defense, and Phorion says the same. Three cases undo the macOS one.
The first is a Mac that already had Remote Login on, which developers who SSH into their own laptops sometimes do. For that machine the check didn’t matter and the backdoor works as designed. The second is a Mac where Remote Login gets turned on later. The key is still in authorized_keys and the LaunchAgent keeps the tunnel coming back, so “the backdoor is ready and waiting.” The third is any Linux machine that already runs sshd, which includes every remote dev box people reach over SSH in the first place. On those, enablement was never needed.
The beacon also works whether or not SSH ever opens. It sends names, not values, so no secret leaves the machine that way. A list of names is still useful to an attacker. A machine reporting AWS_SECRET_ACCESS_KEY and ANTHROPIC_API_KEY is a better target than one reporting nothing, and the regex is broad enough to catch most of what a developer keeps in their shell. This is the part I’d weigh most. It is also the kind of exposure academic work on editor extensions already pointed at: a 2025 study of 27,261 VS Code extensions found that 8.5%, or 2,325, were exposed to credential-related data leakage through commands, user input and configuration. That study looked at well-meaning extensions that handled secrets carelessly. A backdoor doesn’t have to wait for a mistake like that, because it runs with the editor’s rights from the moment it loads.
Phorion’s remediation list follows from this. Uninstalling the extension “alone won’t remove the backdoor.” Responders need to kill the tunnel loop, remove the LaunchAgent or cron entry or scheduled task, delete ~/.config/.smt, ~/.config/.smtk and /tmp/.stk_*, remove the planted key, and rotate credentials if SSH was enabled on the host or there is any evidence of an inbound login. Those logins would show up in SSH logs as coming from localhost, because they arrive through the port forward. The advisory also notes the payload dedupes on the comment svc-telemetry rather than the key itself, so hunting should match the key’s fingerprint.
A version number Anthropic never published to npm
One more check is cheap. The Claude Code extension uses the same version numbers as the Claude Code CLI that Anthropic publishes to npm. On Open VSX, the extension’s 2.1.311, 2.1.312 and 2.1.314 builds each appear within about two hours of the npm release with the same number. The npm registry record for @anthropic-ai/claude-code lists 2.1.312 at 18:36 UTC on 27 October and 2.1.314 at 00:12 UTC on 30 October. It lists no 2.1.313.
On its own the gap proves little. Skipped version numbers happen for ordinary reasons, and the gap doesn’t tell us how the bundle got onto the marketplace or who published it there. It does give anyone who installed from the Cursor Marketplace a quick test: if your installed version has no matching npm release, find out where it came from. The extension directory name, anthropic.claude-code-2.1.313-<platform>, is enough to check.
The trust problem the bug doesn’t touch
The attack’s sloppy code makes it easy to read the advisory as good news. I think that’s a mistake. The parts that broke are the parts that needed privileges the payload never had. The parts that worked, the planted key, the persistence and the inventory of secret names, needed nothing beyond what any editor extension already gets. In their taxonomy of attacks on open-source supply chains, Ladisa and colleagues built an attack tree of 107 vectors, linked to 94 real incidents. The goal at the root of that tree is malicious code inside an artifact that victims download and run. A marketplace copy of a coding agent’s extension is that kind of artifact, and a backdoor in it starts running when the editor loads it.
A better-written payload would have used the same entry point and fixed the macOS check. The defense has to come from the distribution side: knowing which build of an extension came from its publisher, and noticing when a marketplace serves a version the publisher never released.
References
- Hall, C. (2026). Official Claude Code Extension Compromise: Security Advisory. Phorion, 30 October 2026.
- npm, Inc. (2026). @anthropic-ai/claude-code registry record. Version publish times for 2.1.309–2.1.314, 22–30 October 2026.
- Eclipse Foundation (2026). anthropic.claude-code on Open VSX. Version publish times for 2.1.311, 2.1.312 and 2.1.314, 26–30 October 2026.
- Liu, Y., Tantithamthavorn, C. and Li, L. (2025). Protect Your Secrets: Understanding and Measuring Data Exposure in VSCode Extensions. 2025 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), 551–562, March 2025.
- Ladisa, P., Plate, H., Martinez, M. and Barais, O. (2023). SoK: Taxonomy of Attacks on Open-Source Software Supply Chains. 2023 IEEE Symposium on Security and Privacy (SP), 1509–1526, May 2023.