Backdoor Discovered in Claude Code Extension on Cursor Marketplace
Malicious extension compromises developer environments by establishing persistent SSH backdoors across major operating systems.
1Compromised Extension Discovery
Phorion identified a malicious backdoor within the official Claude Code extension, version 2.1.313, hosted on the Cursor Marketplace. The compromised bundle contains logic to establish persistent SSH access across macOS, Linux, and Windows. Cursor has since removed the affected release and pulled the version from relevant NPM and VSCode registries.
2Execution Mechanism
The malicious payload uses an injected immediately invoked function expression prepended to the minified extension bundle. This code executes as soon as Node.js loads the file, bypassing the standard extension activation callback. Consequently, the backdoor fires immediately without requiring any user interaction or specific IDE activity to trigger the initial compromise.
3SSH Key Injection
The script ensures the ~/.ssh directory exists and appends an attacker-controlled Ed25519 public key, labeled svc-telemetry, to the authorized_keys file. It sets strict permissions of 0700 on the directory and 0600 on the file. Investigators should monitor for this specific key fingerprint rather than relying on the comment string.
4MacOS Implementation Bug
A critical implementation flaw exists on macOS regarding SSH enablement. The script attempts to check Remote Login status using systemsetup -getremotelogin without root privileges. Because standard users lack permission, the command fails and returns an error. The script misinterprets this failure, causing it to skip the SSH enablement step entirely.
5Tunneling and Access
The malware establishes an outbound SSH tunnel to 134.209.82.225 using an embedded private key. It utilizes remote port forwarding with the -R *:0:localhost:22 flag, allowing the attacker to dynamically allocate a port. This setup enables full interactive shell access and file transfer capabilities without needing custom command-and-control infrastructure within the JavaScript.
6Persistence Mechanisms
To survive system reboots, the malware employs platform-specific persistence. On macOS, it creates a LaunchAgent disguised as com.apple.sysmond.plist within ~/Library/LaunchAgents/. This ensures the reconnection loop remains active. The tunnel process is detached, meaning it persists even after the user closes the Cursor IDE, maintaining a continuous connection to the attacker.
7Host Reconnaissance Beacon
The script performs host reconnaissance by scanning environment variables for sensitive strings like KEY, TOKEN, SECRET, or AWS. It beacons this inventory to 134.209.82.225:8099 via plaintext HTTP POST requests. While it does not exfiltrate the actual secret values, it provides the operator with a priority list of valuable targets.
8Detection Strategy
Standard process-based monitoring often fails because the extension host modifies authorized_keys directly via Node.js file system calls. Security teams must implement file modification telemetry to alert on IDE helper processes touching SSH configuration files. Correlating the creation of .smt scripts and LaunchAgents back to the extension host is essential.
9Investigating SSH Logs
If an attacker successfully logs in, SSH logs will show connections originating from localhost, specifically 127.0.0.1 or ::1, authenticating with the svc-telemetry key. Investigators should check these logs to determine if the tunnel was merely established or if an operator actively accessed the machine through the planted backdoor.
10Remediation Requirements
Uninstalling the malicious extension is insufficient for full remediation. Organizations must manually remove the dropped SSH keys, delete the com.apple.sysmond.plist LaunchAgent, and terminate any active detached SSH tunnel processes. Failure to address these persistence layers leaves the machine vulnerable to continued unauthorized access despite removing the original extension bundle.
11Supply Chain Risks
This incident underscores the inherent risks of IDE extensions, which operate with the full permissions of the user and the IDE. Because these tools have access to local source code and developer credentials, they represent a high-value target for supply chain attacks. Continuous monitoring of extension behavior remains a critical security requirement.
Original article: Hacker News — Backdoor Discovered in Claude Code Extension on Cursor Marketplace