# Backdoor Discovered in Claude Code Extension on Cursor Marketplace Malicious extension compromises developer environments by establishing persistent SSH backdoors across major operating systems. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/5dc42bc7-ea73-4dec-9b69-1f4564e23682 ## Compromised Extension Discovery Phorion identified a malicious backdoor within the official Claude Code for VS Code extension, version 2.1.313, hosted on the Cursor Marketplace. The compromised bundle contains an injected immediately invoked function expression that executes upon loading. This allows the payload to run before the extension's standard activation callback, bypassing typical user interaction requirements. ## SSH Backdoor Mechanism The malware attempts to establish persistent access by appending an attacker-controlled Ed25519 public key, labeled svc-telemetry, to the user's ~/.ssh/authorized_keys file. It sets strict permissions on the directory and file to ensure stability. This configuration grants the attacker the ability to authenticate as the victim user, provided the SSH daemon is active. ## MacOS Implementation Flaw A critical implementation bug exists in the macOS setup logic. The script attempts to check the remote login status using systemsetup -getremotelogin without root privileges. Because this command fails for standard users, the script incorrectly assumes the service is already enabled. Consequently, the enablement step is skipped, potentially breaking the inbound access path. ## Outbound Tunneling Strategy The payload initiates an outbound SSH connection to 134.209.82.225 using an embedded private key. It employs remote port forwarding with the -R *:0:localhost:22 flag, allowing the attacker to dynamically allocate a listening port. This architecture enables full interactive shell access and file transfer capabilities without requiring complex command-and-control logic within the JavaScript code. ## Persistence and Execution To survive system reboots, the malware establishes platform-specific persistence. On macOS, it creates a LaunchAgent disguised as com.apple.sysmond.plist within the ~/Library/LaunchAgents/ directory. This ensures the malicious tunnel remains active even after the user closes their IDE, maintaining a persistent connection to the attacker's infrastructure through a detached retry loop. ## Host Reconnaissance Beacon The script performs basic host reconnaissance by scanning environment variables for sensitive strings like KEY, TOKEN, SECRET, or AWS. It collects these variable names and sends a JSON report via plaintext HTTP POST requests to the attacker's server. This beaconing provides the operator with an inventory of available cloud credentials and API tokens. ## Detection via File Telemetry Standard process-based detection often fails because the malware uses Node.js fs.appendFileSync to modify SSH files directly. Security teams must prioritize file modification telemetry, specifically monitoring IDE helper processes like Code Helper or Cursor Helper. Any attempt by these processes to write to ~/.ssh/authorized_keys should be treated as a high-fidelity indicator of compromise. ## Process Tree Analysis Because the initial tunnel is spawned as a detached process, the subsequent SSH processes lack the IDE as their immediate parent. Investigators should correlate the creation of the .smt configuration file and the com.apple.sysmond.plist LaunchAgent back to the IDE extension host process to effectively reconstruct the full attack chain. ## Incident Response Requirements Uninstalling the extension is insufficient to remediate the threat. Organizations must manually remove the planted SSH keys, delete the malicious LaunchAgent files, and terminate the detached SSH tunnel processes. Failure to perform these comprehensive cleanup steps leaves the backdoor active, allowing the attacker to maintain persistent access to the compromised developer machine. ## SSH Log Investigation When auditing affected machines, check SSH logs for successful logins originating from localhost or 127.0.0.1. Since inbound sessions arrive through the local port forward, these connections will appear to authenticate using the svc-telemetry key. This local authentication pattern is a definitive sign that an operator has successfully utilized the established backdoor. ## Supply Chain Security Impact This incident highlights the inherent risks of IDE extensions, which operate with the full permissions of the user and the development environment. As extensions gain access to source code and local tooling, they represent a significant supply chain attack vector. Organizations must implement stricter controls over extension installation and monitor background process activity. ## Sources covering this story - https://phorion.io/blog/offical-claude-code-vsx-compromise/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._