What Happened
On 29 October 2026, a tampered build of Anthropic’s Claude Code extension — version 2.1.313 — appeared on Cursor’s extension marketplace. The malicious version was available for approximately 11 hours (roughly 2:27 a.m. to 1:35 p.m. PT) before Cursor pulled it. Up to 5,000 Cursor users may have received it as a routine extension update.
This was not a fake extension with a similar name. It was distributed under the legitimate extension ID (anthropic.claude-code), which means it appeared to users as a standard update to the trusted, Anthropic-published extension they already had installed. Cursor has confirmed the malicious code was not developed by Anthropic.
How attackers gained the ability to push a modified build under the legitimate extension’s identity remains unclear at the time of writing. The compromise did not affect the Microsoft Visual Studio Marketplace or the official @anthropic-ai/claude-code npm package.
The attacker didn’t need to trick users into installing something suspicious. The malware arrived as what looked like a routine update from a trusted vendor, through a trusted distribution channel. That’s what makes supply chain attacks so effective — and so dangerous for development teams.
What the Malware Did
The attacker prepended a 66-line obfuscated IIFE (immediately invoked function expression) to the beginning of the legitimate extension.js bundle. The injected code ran on extension activation — which happens automatically at VS Code startup — before the real extension logic loaded. No user interaction was required. The rest of the extension functioned normally, making the compromise invisible to the user.
The payload performed four actions:
Collected hostname, username, OS, architecture, home directory, working directories, global Git email, and public IP address. It also harvested the names (not values) of up to 40 environment variables matching patterns like KEY, TOKEN, SECRET, PASS, AWS, or GCP — giving the attacker an inventory of which machines hold cloud credentials.
Appended the attacker’s Ed25519 public key (labelled svc-telemetry) to ~/.ssh/authorized_keys, granting persistent login access to the user’s account without a password.
Decoded an embedded private key into a temporary file and opened an outbound SSH connection to the attacker’s server at 134.209.82.225. The tunnel used a reverse port forward (-R) to map back to the victim’s port 22, giving the operator remote shell access. On Unix systems, it preferred autossh with 60-second reconnection, meaning the tunnel persisted after the editor was closed.
Installed a startup mechanism so the backdoor would survive reboots:
- macOS: A LaunchAgent named
com.apple.sysmond.plist(designed to look like an Apple system component) - Linux: An
@rebootcrontab entry - Windows: A scheduled task named
SysMon, with a fallback to asysmon.cmdfile in the Startup folder
After a 1.5-second delay, the payload looked up the victim’s public IP (via ifconfig.me and api.ipify.org) and POSTed the collected reconnaissance data to port 8099 on the command-and-control server. No additional executables were downloaded — the damage was done entirely through the injected JavaScript and standard system tools like ssh and autossh.
The payload attempted to enable Remote Login (SSH) on macOS but typically failed because it lacked admin rights. However, if Remote Login was already enabled — or was enabled later — the injected SSH key and reverse tunnel were fully functional. Don’t assume you’re safe just because you’re on a Mac.
Why This Matters for Businesses
Developer machines are high-value targets. They typically have access to source code repositories, cloud infrastructure credentials, deployment pipelines, production databases, and internal APIs. A compromised developer workstation can be the starting point for a much larger breach — from intellectual property theft to ransomware deployment across the entire organisation.
This incident also demonstrates the growing risk of supply chain attacks through AI coding tools. As AI-assisted development becomes standard, the extension marketplaces and package registries that distribute these tools become increasingly attractive targets. A single compromised update can reach thousands of developers who implicitly trust their toolchain.
For Melbourne businesses using AI development tools, this is a reminder that the software supply chain — especially third-party extensions and marketplace-distributed tools — needs the same security scrutiny as any other component of your IT environment.
How to Check If You’re Affected
If you or anyone in your team used Cursor and had the Claude Code extension installed around 29 October 2026, check the following:
Check extension version
In Cursor, check if anthropic.claude-code is or was version 2.1.313. Versions 2.1.312 and 2.1.314 have been verified as clean.
Check SSH authorized keys
Look for the attacker’s SSH key labelled svc-telemetry:
grep svc-telemetry ~/.ssh/authorized_keysSelect-String svc-telemetry $env:USERPROFILE\.ssh\authorized_keysIf this returns a match, the backdoor was installed on your machine.
Check for persistence files
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist
ls -la ~/.config/.smt ~/.config/.smtkcrontab -l | grep -i reboot
ls -la ~/.config/.smt ~/.config/.smtkschtasks /query /tn SysMon
Test-Path "$env:USERPROFILE\.config\smt.cmd"
Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"Check for active tunnel processes
ps aux | grep -E "autossh|ssh .*-R"
ls "${TMPDIR:-/tmp}"/.stk_*Get-Process | Where-Object { $_.Name -match "ssh|autossh" }
Get-ChildItem "$env:TEMP\.stk_*"Check for network connections to the C2 server
netstat -an | grep 134.209.82.225
# or
ss -tnp | grep 134.209.82.225netstat -an | Select-String "134.209.82.225"Remediation Steps
If any of the checks above returned positive results, take the following steps immediately:
Disconnect from the network immediately. The reverse tunnel reconnects every 60 seconds, so leaving the machine online gives the attacker continued access.
Before deleting anything, capture logs and the persistence files listed above. If you have an incident response process, activate it now.
At your firewall or endpoint level, block all traffic to 134.209.82.225 on ports 22 and 8099. Cursor has confirmed the server has been taken offline, but block it anyway.
- Remove the
svc-telemetryline from~/.ssh/authorized_keys - Delete the persistence files for your OS (listed in the detection section above)
- Kill any
sshorautosshprocesses using reverse forwards - Remove temp files matching
.stk_*in your temp directory - Uninstall the Claude Code extension and reinstall version 2.1.314 or later
Using a separate, unaffected computer, rotate every credential that was accessible from the compromised machine: SSH keys, API tokens, cloud provider credentials (AWS, GCP, Azure), Git tokens, database passwords, and any service accounts. The malware collected environment variable names, so the attacker knows which credential types your machine held.
If the backdoor was active and the reverse tunnel was functional, the attacker may have had interactive shell access. In that case, deleting known persistence files may not be sufficient — a full rebuild is the safest option.
Indicators of Compromise (IoCs)
| Indicator | Value |
|---|---|
| Malicious extension | anthropic.claude-code v2.1.313 |
| Malicious extension.js SHA-256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 |
| C2 server | 134.209.82.225 (ports 22, 8099) |
| Beacon endpoint | http://134.209.82.225:8099/beacon |
| SSH key comment | svc-telemetry |
| SSH key fingerprint | SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk |
| Tunnel key SHA-256 | 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 |
| macOS persistence | ~/Library/LaunchAgents/com.apple.sysmond.plist |
| Linux persistence | @reboot crontab entry |
| Windows persistence | Scheduled task SysMon; Startup sysmon.cmd |
| Config files | ~/.config/.smt, ~/.config/.smtk, ~/.config/smt.cmd |
| Temp files | .stk_* in system temp directory |
Lessons for Businesses Using AI Development Tools
This incident isn’t a reason to stop using AI coding tools. It’s a reason to treat them with the same security rigour as every other piece of software in your environment:
Don’t auto-update extensions in development environments. Review changelogs and wait 24–48 hours before applying updates to give the community time to spot anomalies.
Regularly audit ~/.ssh/authorized_keys on developer machines. Any key you didn’t explicitly add should be investigated immediately.
Developer workstations should not have standing access to production systems. Use just-in-time access, separate credentials for different environments, and avoid storing long-lived secrets in environment variables.
Endpoint detection and response (EDR) tools should flag unexpected SSH tunnels and connections to unfamiliar IP addresses. If your dev machines aren’t covered by EDR, they should be.
AI coding assistants, extension marketplaces, and IDE plugins are part of your attack surface. Include them in your risk assessments and your Essential Eight application control and patching strategy.
Frequently Asked Questions
Was the official Claude Code extension from Anthropic compromised?
No. The malicious code was not developed by Anthropic. An attacker injected a backdoor into version 2.1.313, which was distributed through Cursor’s marketplace under the legitimate extension ID. The official npm package (@anthropic-ai/claude-code) and the Microsoft Visual Studio Marketplace listing were not affected.
How do I check if I’m affected?
Run grep svc-telemetry ~/.ssh/authorized_keys on macOS or Linux, or Select-String svc-telemetry $env:USERPROFILE\.ssh\authorized_keys on Windows. If you get a match, the backdoor’s SSH key was installed on your machine. See the full detection steps above.
Does uninstalling the extension remove the backdoor?
No. Uninstalling the extension does not remove the injected SSH key, the persistence mechanisms (LaunchAgent, crontab, scheduled task), or the tunnel processes. These components operate independently of the extension and must be removed manually.
I use VS Code, not Cursor. Am I affected?
The malicious version was distributed through Cursor’s marketplace specifically. The Microsoft Visual Studio Marketplace was not affected. If you only use VS Code with extensions from the official Microsoft marketplace, this specific incident does not affect you.
Should I stop using AI coding tools?
No. But treat them with the same security awareness as any other software. Pin versions, review updates before applying them, monitor your development machines for unexpected behaviour, and include IDE extensions in your organisation’s security policy.
Timeline
~2:27 a.m. PT
~1:35 p.m. PT
Need Help Checking Your Environment?
If your development team uses Cursor or other AI coding tools and you’re not sure whether your machines are affected — or you want to make sure your development environment is properly secured against supply chain attacks — we can help.
Melbits works with Melbourne businesses to assess and harden IT environments, including developer workstations, against exactly these kinds of threats. Our security assessments cover endpoint security, access controls, credential management, and supply chain risk.