The Claude Code Extension Backdoor on the Cursor Marketplace

What happened

An attacker used access to the Cursor Marketplace to publish a modified Claude Code extension. The Cursor security notice says the bad versions were live from about 2:27am PT to 1:35pm PT on 29 October 2026. Cursor removed them, shut the marketplace down, rotated its keys and rebuilt it. Cursor says no other extension was tampered with.

Phorion found the backdoor. Its write-up says the attacker added a block of code to the top of extension.js. The rest of the file looked like the normal extension. The added code ran as soon as Cursor loaded the file, before the extension started. The user did not need to click anything.

The code did four things:

1. It added an attacker public key, labelled svc-telemetry, to ~/.ssh/authorized_keys. With that key the attacker can log in as the user if SSH is running on the machine.
2. It tried to turn on the SSH service. On macOS it used systemsetup. On Windows it tried to install OpenSSH Server.
3. It opened an outbound SSH tunnel to 134.209.82.225 with an embedded private key. The tunnel lets the attacker reach port 22 on the victim's machine. A background loop retried the tunnel about every 60 seconds.
4. It sent the hostname, username, operating system, home folder, working folder, Git email and public IP to the attacker. It also sent up to 40 environment variable names that look like keys or tokens. It sent the names only, not the values.

For persistence, it added a LaunchAgent named com.apple.sysmond on macOS. On Windows it tried a scheduled task named SysMon that runs as SYSTEM, with a Startup folder script as the fallback.

Both Cursor and Phorion say the SSH step fails on most machines. Turning on the SSH service needs admin rights, and the extension does not have them. Phorion also found a bug in the macOS check that skips that step for a normal user. The key, the persistence and the report to the attacker still went through. If a user turns on Remote Login later, the backdoor works. Cursor worked with the hosting provider to take the attacker's server offline.

Affected versions

• Anthropic.claude-code 2.1.312 and 2.1.313 from the Cursor VS Code Extension Marketplace.
• Platforms: macOS and Windows builds. The code also holds Linux steps.
• Exposure window: 29 October 2026, about 2:27am PT to 1:35pm PT.
• Not affected: the Claude Code extension from Anthropic's own channels and other extensions on the Cursor Marketplace.

Indicators of compromise

• Attacker server: 134.209.82.225. Reverse SSH as tunnel@134.209.82.225 on TCP 22. Beacon: HTTP POST to 134.209.82.225:8099/beacon and to 127.0.0.1:8099/beacon.
• SSH key comment svc-telemetry in authorized_keys. Key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.
• macOS and Linux files: ~/.config/.smt, ~/.config/.smtk and a temp file named .stk_ plus 10 hex characters.
• macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist.
• Linux: a crontab line @reboot /bin/sh that runs ~/.config/.smt.
• Windows: %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, a scheduled task named SysMon and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd.
• Processes: ssh -N -R '*:0:localhost:22' or autossh -M 0 to the attacker server.
• SHA-256 of the modified extension.js: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.
• SHA-256 of the 2.1.312 VSIX for macOS ARM: fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364. For Windows x64: 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081.
• SHA-256 of the 2.1.313 VSIX for macOS ARM: 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c. For Windows x64: 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731.

Lookups to ifconfig.me and api.ipify.org are part of the attack, but those services are legitimate. A lookup alone is not an indicator.

How to check

Look for the attacker key in your SSH authorized keys. Cursor gives this check for macOS:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found"

Then look for the persistence files:

ls -l ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist

The second command lists only files that exist. Missing files give an error, which is a good result. On Windows, search %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry. Then look for the SysMon task and the Startup script. The key comment can be changed, so also compare the key fingerprint in the list above.

What to do now

1. If the key or the files are present, isolate the machine.
2. Run the remediation script from the Cursor notice. On macOS, run it as the affected user, not as root. On Windows, run it from an admin PowerShell. The scripts remove the extension, the key, the persistence and the tunnel processes.
3. Do not rely on removing the extension only. The persistence scripts keep running without it.
4. Rotate credentials and sessions that the machine can reach. Do this from a different, trusted machine. The beacon sent only variable names, but the backdoor can give later access to the values.
5. Decide if the machine needs a rebuild. Cursor advises that you assess this.
6. Block 134.209.82.225 at the network edge.

What Vigilance would show (rebuilt from public reports)

Vigilance compares the version you trust with the new one and names the file that gained a new power. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 27 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   extension.js
           It reads saved passwords and access keys and restarts itself after a reboot.

Sources

1. cursor.com/blog/claude-code-extension-security-notice
2. phorion.io/blog/offical-claude-code-vsx-compromise/