Security researchers at Phorion have identified a significant compromise in the official Claude Code for VS Code extension bundle hosted on the Cursor Marketplace. The malicious version, identified as 2.1.313, contains a backdoor designed to establish persistent Secure Shell (SSH) access on macOS, Linux, and Windows systems. Because VS Code extensions run with the same permissions as the IDE and the user, the compromised module gains immediate access to local files, source code, and developer tooling as soon as it is loaded by the host application.
The image serves as a visual anchor for the security advisory regarding the compromised extension bundle.
This icon relates to the developer tools and source code that the compromised extension can access.
The infection chain begins with an injected immediately invoked function expression (IIFE) prepended to the minified extension bundle. This code executes before the extension's standard activation logic, allowing it to run without any user interaction. The payload first modifies the user's `~/.ssh/authorized_keys` file by appending an attacker-controlled Ed25519 public key. It then attempts to enable the local SSH daemon. While the malware includes logic to enable Remote Login on macOS, Linux, and Windows, researchers noted a specific implementation bug on macOS: the script fails to correctly interpret the output of the `systemsetup` command when run without root privileges, which may prevent the automated enablement of SSH on some systems.
Beyond local configuration, the malware establishes a reverse SSH tunnel to a remote server (134.209.82.225). It uses an embedded private key to authenticate and sets up a port forward that allows an attacker to connect to the victim's machine via a dynamically allocated port on the attacker's server. To ensure the tunnel survives reboots, the script installs platform-specific persistence, such as a LaunchAgent on macOS or a scheduled task on Windows. Finally, the script performs host reconnaissance, beaconing the victim's hostname, OS architecture, and a list of environment variable names—specifically those matching patterns like `KEY`, `TOKEN`, or `SECRET`—to the attacker's infrastructure to identify high-value targets for further exploitation.
Cursor has since removed the compromised release from its marketplace and pulled the affected versions from NPM and VS Code registries. However, security researchers warn that removing the extension from a marketplace does not remediate machines already infected by the bundle. Organizations are advised to audit their environments for the presence of version 2.1.313 and monitor for unauthorized modifications to SSH configuration files or the creation of unexpected LaunchAgents and scheduled tasks.