Versions 2.1.312 and 2.1.313 of the official Claude Code extension for Visual Studio Code, downloaded from the Cursor Marketplace on macOS and Windows, contained code injected ahead of the extension’s own activation. Security vendor Phorion published a detailed advisory on October 30, updated the next day after Cursor confirmed the issue and pulled both versions from its marketplace.
Code That Ran Before the Extension Activated
According to Phorion, the extension.js file carried an injected prefix that executed as soon as Node loaded it, ahead of the activate callback normally expected by the VS Code extension API. No action beyond installing the trojanized package was required from the victim.
A Four-Stage Chain
The advisory describes a compromise built to survive a simple reboot.
| Stage | Action | Technical detail |
|---|---|---|
| 1 | Remote access | An Ed25519 public key (comment svc-telemetry) appended to ~/.ssh/authorized_keys, with an attempt to enable SSH |
| 2 | Outbound tunnel | Reverse SSH connection to 134.209.82.225 using an embedded private key, with -R *:0:localhost:22 |
| 3 | Persistence | A com.apple.sysmond LaunchAgent on macOS, a @reboot cron entry on Linux, a “SysMon” scheduled task on Windows |
| 4 | Reconnaissance | A plaintext HTTP beacon to port 8099 carrying hostname, user, OS, public IP, and the names (not values) of credential-pattern environment variables |
One detail limits the impact on macOS: the systemsetup -getremotelogin command returns an exit status of zero even on a permissions error, which fools the script into skipping the actual Remote Login toggle on machines where it wasn’t already on. The planted key and the persistence mechanism still get installed regardless.
Uninstalling the extension alone does not remove the backdoor: the keys, the tunnel and the persistence task survive the package’s removal.
Affected installs: the Claude Code extension for VS Code, versions 2.1.312 and 2.1.313, installed through the Cursor Marketplace on macOS or Windows. Phorion’s advisory does not name Microsoft’s own Visual Studio Marketplace.
Recommended Cleanup
Phorion lays out a multi-step remediation to run once the suspect machine is off the network:
# Kill the tunnel and any suspicious ssh/autossh processes
pkill -f "134.209.82.225"
# macOS: remove persistence
launchctl unload ~/Library/LaunchAgents/com.apple.sysmond.plist
rm -f ~/Library/LaunchAgents/com.apple.sysmond.plist
rm -f ~/.config/.smt ~/.config/.smtk /tmp/.stk_*
# Remove the planted key
sed -i '/svc-telemetry/d' ~/.ssh/authorized_keys
# Confirm Remote Login was not silently enabled
sudo systemsetup -getremotelogin
Rotating any credentials reachable from the affected account rounds out the procedure. The SHA-256 fingerprints of the trojanized file and the planted keys are listed in the original advisory, useful for sweeping a fleet of machines for indicators of compromise.
A Supply Chain Under Strain
The incident joins a run of recent warnings about how extensions and packages reach AI-assisted development tools. GitHub, for one, opened a public preview of an npm package firewall meant to screen suspicious dependencies before install. The underlying question is the same each time: default trust in an extension marketplace, whether run by an established vendor or a newer fork like Cursor, rests on publishing controls that still vary widely from one registry to the next.
For teams that stock their development machines with a chosen set of command-line utilities, the episode is a reminder to limit install sources and check published fingerprints before an automatic update lands.
What to Remember
Two versions of the Claude Code extension distributed through the Cursor Marketplace carried a full backdoor: remote SSH access, a tunnel to a command server, cross-platform persistence, and host reconnaissance. Cursor pulled the packages, but uninstalling alone is not enough: the cleanup procedure and rotating exposed credentials remain necessary on any machine that installed either affected version.
This kind of incident no longer surprises anyone in the IDE extension ecosystem, but each occurrence still deserves to be taken seriously: publishers of code-assistant extensions sit on development machines loaded with credentials, which makes them prime targets. Checking published fingerprints before an update, even from a trusted vendor, costs a few minutes and can prevent a full machine compromise — Simon Janvier.
Further reading: Phorion’s full advisory, with indicators of compromise and a detailed timeline.
