Backdoor Discovered in Claude Code Extension on Cursor Marketplace
Malicious extension compromises developer environments by establishing persistent SSH backdoors across major operating systems.
1Compromised Extension Discovery
Phorion identified a malicious backdoor within the official Claude Code for VS Code extension, version 2.1.313, hosted on the Cursor Marketplace. The compromised bundle contains an injected immediately invoked function expression that executes upon loading. This allows the payload to run before the extension's standard activation callback, bypassing typical user interaction requirements.
2SSH Backdoor Mechanism
The malware attempts to establish persistent access by appending an attacker-controlled Ed25519 public key, labeled svc-telemetry, to the user's ~/.ssh/authorized_keys file. It sets strict permissions on the directory and file to ensure stability. This configuration grants the attacker the ability to authenticate as the victim user, provided the SSH daemon is active.
3MacOS Implementation Flaw
A critical implementation bug exists in the macOS setup logic. The script attempts to check the remote login status using systemsetup -getremotelogin without root privileges. Because this command fails for standard users, the script incorrectly assumes the service is already enabled. Consequently, the enablement step is skipped, potentially breaking the inbound access path.
4Outbound Tunneling Strategy
The payload initiates an outbound SSH connection to 134.209.82.225 using an embedded private key. It employs remote port forwarding with the -R *:0:localhost:22 flag, allowing the attacker to dynamically allocate a listening port. This architecture enables full interactive shell access and file transfer capabilities without requiring complex command-and-control logic within the JavaScript code.
5Persistence and Execution
To survive system reboots, the malware establishes platform-specific persistence. On macOS, it creates a LaunchAgent disguised as com.apple.sysmond.plist within the ~/Library/LaunchAgents/ directory. This ensures the malicious tunnel remains active even after the user closes their IDE, maintaining a persistent connection to the attacker's infrastructure through a detached retry loop.
6Host Reconnaissance Beacon
The script performs basic host reconnaissance by scanning environment variables for sensitive strings like KEY, TOKEN, SECRET, or AWS. It collects these variable names and sends a JSON report via plaintext HTTP POST requests to the attacker's server. This beaconing provides the operator with an inventory of available cloud credentials and API tokens.
7Detection via File Telemetry
Standard process-based detection often fails because the malware uses Node.js fs.appendFileSync to modify SSH files directly. Security teams must prioritize file modification telemetry, specifically monitoring IDE helper processes like Code Helper or Cursor Helper. Any attempt by these processes to write to ~/.ssh/authorized_keys should be treated as a high-fidelity indicator of compromise.
8Process Tree Analysis
Because the initial tunnel is spawned as a detached process, the subsequent SSH processes lack the IDE as their immediate parent. Investigators should correlate the creation of the .smt configuration file and the com.apple.sysmond.plist LaunchAgent back to the IDE extension host process to effectively reconstruct the full attack chain.
9Incident Response Requirements
Uninstalling the extension is insufficient to remediate the threat. Organizations must manually remove the planted SSH keys, delete the malicious LaunchAgent files, and terminate the detached SSH tunnel processes. Failure to perform these comprehensive cleanup steps leaves the backdoor active, allowing the attacker to maintain persistent access to the compromised developer machine.
10SSH Log Investigation
When auditing affected machines, check SSH logs for successful logins originating from localhost or 127.0.0.1. Since inbound sessions arrive through the local port forward, these connections will appear to authenticate using the svc-telemetry key. This local authentication pattern is a definitive sign that an operator has successfully utilized the established backdoor.
11Supply Chain Security Impact
This incident highlights the inherent risks of IDE extensions, which operate with the full permissions of the user and the development environment. As extensions gain access to source code and local tooling, they represent a significant supply chain attack vector. Organizations must implement stricter controls over extension installation and monitor background process activity.