Back opensourcemalware.com

OpenSourceMalware

opensourcemalware.com • October 30, 2026

UPDATE: OpenSourceMalware has been contacted by Cursor and they've let us know that the Claude Code extension in the Cursor Marketplace experienced some form of compromise today and this is the origin of the malicious Claude Code extension, not Open-VSX

You can see Cursor's announcement the incident HERE .

The official Claude Code extension in the Cursor marketplace was compromised today. Yes, you heard that right.

A malicious version, 2.1.313 was published to the Cursor Marketplace, today, October 29th, 2026. The extension identifies itself as anthropic.claude-code version 2.1.313 , but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code.

Claude-code extension from Cursor marketplace version 2.1.313

What is not malicious:

The @anthropic-ai/claude-code NPM package is NOT malicious

The OpenVSX extension is NOT malicious

The Microsoft VSCode extension for Claude is NOT malicious

The unpacked extension is exactly like the normal version, and the bundled binary is the official binary as well. The only thing that's different is the extension.js file.

The extension activates after VS Code startup and when its webview opens and runs the extension.js file. It adds an attacker-controlled key to the user’s SSH configuration, attempts to enable the local SSH service, establishes a reverse tunnel to 134.209.82.225 , installs platform-specific persistence, and transmits host reconnaissance over an unencrypted HTTP beacon.

Static inspection of the main entry point quickly paints a picture: The first line starts a standalone, immediately invoked function that imports Node.js process, filesystem, operating-system, HTTP, and cryptographic modules. That function ends at line 66. Only after it finishes does the expected bundled extension begin. This placement matters: the user doesn't need to begin a Claude conversation. Loading the extension module is enough. The package declares no install, build, prepare, preinstall, or postinstall scripts, so the malicious behavior occurs at extension runtime rather than through a package-manager lifecycle hook.

The provenance of the analyzed directory is not established. These findings show that this specific artifact is malicious; they do not, by themselves, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised.

Threat Type: Trojanized developer-tool extension and persistent SSH backdoor

Affected Ecosystem: Visual Studio Code extensions

Claimed Package: anthropic [email protected]

Impact: Persistent remote access through an authorized SSH key and reverse SSH tunnel

C2: 134.209.82.225 over SSH and HTTP port 8099

Key Finding: Malicious code is prepended to the normal extension bundle and executes before legitimate initialization

Additional Payloads: None downloaded by the injected stage; its curl requests retrieve only public-IP text

Big shout out to Dean Hardcastle for looping us in when he saw this happen in real time.

Immediate reconnaissance

At load time, the implant collects:

Hostname and local username

Operating system and CPU architecture

directory and current working directory

Global Git email from git config --global user.email

Names of up to 40 environment variables containing KEY , TOKEN , SECRET , PASS , AWS , or GCP

Environment-variable values are not placed directly in the initial beacon. Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly.

Nearly every exception is suppressed. This lets the legitimate extension continue loading when malicious operations fail, reducing visible signs of compromise.

Authorized-key installation

If a directory is available, the implant creates ~/.ssh , changes it to mode 0700 , and appends an Ed25519 key to ~/.ssh/authorized_keys . The key is labeled svc-telemetry , an innocuous-looking intended to resemble an administrative account.

The implant sets authorized_keys to mode 0600 . If the marker already exists, it records that fact instead of adding a duplicate.

SSH service enablement

The branch attempts to make the victim reachable through SSH:

macOS: checks Remote Login and, if disabled, runs sudo -n systemsetup -setremotelogin on

Linux: checks sshd or ssh with systemctl , then tries several service-start commands

Windows: uses PowerShell to install OpenSSH Server, configure automatic startup, and start sshd

These operations may fail without sufficient privileges, but failure does not stop the remaining attack chain.

The implant embeds a base64-encoded OpenSSH private key and decodes it into a temporary file named .stk_ . The identifier derives from the hostname and directory. The decoded private key has SHA-256:

It repeatedly connects to:

The core forwarding request is:

This asks the remote SSH server to allocate a port and forward connections through the tunnel to port 22 on the victim. Whether that port is reachable beyond the C2 host depends on the server’s SSH configuration, but the operator controlling the server can use the tunnel directly.

The connection disables host-key verification, ignores the user’s known-hosts file, uses the embedded identity exclusively, and reconnects after 60 seconds. On Unix-like systems it prefers autossh and otherwise uses ssh .

Platform-specific persistence

The loader implements three platform branches.

.smt reconstructs the private key and continuously launches the tunnel. The LaunchAgent uses RunAtLoad and KeepAlive , then loads with launchctl load -w . The com.apple.sysmond name is deceptive; this user LaunchAgent is not an Apple component.

On Linux, the same files are written under ~/.config , and the script is added to the user’s crontab with an @reboot entry.

On Windows, the malware writes .config\smt.cmd and .config\smtk , then attempts to create an on-start scheduled task named SysMon running as SYSTEM . If that cannot be confirmed, it copies sysmon.cmd into the user’s Startup folder.

Reconnaissance beacon

After 1.5 seconds, the malware obtains the public IP using:

It sends the collected JSON to:

The response is discarded. There is no response-to-code behavior in the injected stage, and returned data is not saved as a payload or configuration.

Does It Download More Malware?

No additional executable or script is downloaded by the injected loader. Its network behaviour consists of public-IP text lookups, JSON beacon uploads, and an interactive SSH tunnel.

The shell and batch scripts and tunnel keys are generated or decoded from content already inside the extension. They are not secondary downloads. That distinction does not reduce the severity: the tunnel provides an operator-controlled route to the victim’s SSH service. Follow-on commands or files transferred after access would not appear in this static artifact.

No blockchain addresses, RPC endpoints, contracts, wallets, or blockchain-resolved payload locations were found.

VS Code loads extension.js

Prepended IIFE runs before legitimate code

directory exists

Adds svc-telemetry authorized key

Attempts to enable SSH or Remote Login

Conditional on OS and privileges

No matching Unix tunnel

Drops embedded key and launches reverse SSH loop

LaunchAgent, cron, scheduled task, or Startup item

Queries public IP and sends two beacons

Response drained and ignored

No downloader identified

Indicators of Compromise (IOCs)

Files and Persistence

File Hashes (SHA-256)

Detection and Response

endpoints for the file paths, SSH key , LaunchAgent label, task name, IP address, and hashes above. On macOS, inspect loaded LaunchAgents and each user’s authorized_keys . Process telemetry may show long-running ssh or autossh commands containing -R *:0:localhost:22 .

If the artifact was loaded, disconnect the system, preserve forensic evidence, and block 134.209.82.225 on ports 22 and 8099. Remove the extension and persistence only after collecting evidence. Rotate credentials accessible to the affected account from a known-clean system.

Because this implant creates an interactive path to SSH, its observable files may not represent the full compromise. Review SSH, shell, process, VS Code, authentication, and network logs for follow-on activity. Rebuilding the host is safer than assuming removal of known artifacts restores trust.

This sample demonstrates an effective way to weaponize a trusted developer tool: place a compact backdoor before a large legitimate bundle, suppress errors, and let the expected application continue. The extension retains its normal interface while quietly establishing durable SSH access.

The evidence supports conclusions the analyzed artifact only. Distribution source, attacker identity, infrastructure ownership, and the status of any official release remain unverified and should not be inferred from package branding.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Trojanized Claude Code Extension Plants SSH Backdoor in Cursor Marketplace On October 29, 2026, a malicious version of the Claude Code extension (version 2.1.313) was available in the Cursor VS Code extension marketplace for approximately 11 hours, affecting up to 5,000 users. This version, not developed by Anthropic, contained a 66-line loader that added an attacker's SSH key, attempted to enable SSH access, and established a reverse SSH tunnel to an external server. The malicious code executed immediately upon loading the extension, collecting user and system information without user interaction. Cursor removed the compromised extension and temporarily took its marketplace offline, later confirming that no other extensions were affected. As of October 30, the attacker's server has been taken offline, but users are advised to follow remediation steps as the backdoor may persist even after uninstalling the extension. 23 sources 60

Extracted Entities

OpenSourceMalware

The full story

Extracted Entities

Attack Types (2)

Companies (3)

Domains (1)

IP Addresses (1)

MITRE ATT&CK (4)

Platforms (4)