{ "schemaVersion": "guard-threat-campaign/v1", "id": "HGTC-2026-3373E5C4", "slug": "claude-code-2-1-313-cursor-marketplace-ssh-backdoor", "title": "Tampered Claude Code 2.1.313 in Cursor's extension marketplace planted a persistent SSH backdoor on developer machines", "aliases": [ "Anthropic.claude-code 2.1.313", "Claude Code VS Code extension compromise", "Cursor marketplace Claude Code backdoor", "svc-telemetry SSH key", "Claude Code extension Open VSX backdoor" ], "summary": "Between about 09:27 and 20:35 UTC on 2026-10-29, the Cursor VS Code extension marketplace served a maliciously modified Anthropic.claude-code version 2.1.313 that Anthropic did not build. Cursor says at most 5,000 users were affected. A 66-line loader prepended to extension.js runs when the extension loads: it appends an attacker Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to tunnel@134.209.82[.]225 that retries about every 60 seconds, installs persistence (macOS LaunchAgent com.apple.sysmond, Linux @reboot crontab, Windows SysMon scheduled task or Startup sysmon.cmd), and POSTs host details, Git email and up to 40 secret-looking environment variable names to hxxp://134.209.82[.]225:8099/beacon. Cursor says enabling SSH fails without admin rights on most macOS and Windows hosts, but the key, persistence and beacon still happen. Cursor removed the version, shut down and rebuilt its marketplace, rotated keys and had the C2 server taken offline. Clean 2.1.314 was published on 2026-10-30.", "status": "published", "severity": "critical", "confidence": "high", "uncertainty": "Sources disagree on Open VSX. Cursor and OpenSourceMalware (after Cursor contacted it) place the origin in the Cursor marketplace and say the Open VSX and Visual Studio Marketplace builds were not malicious. StepSecurity says 2.1.313 was published to Open VSX and mirrored into Cursor. Open VSX returns 404 for 2.1.313, which fits either account. How the package entered the marketplace is not public. Cursor's indicators list only darwin-arm64 and win32-x64 packages; whether a modified Linux package was served is unconfirmed, though the loader has a Linux code path.", "firstObservedAt": "2026-10-29T09:27:00Z", "lastObservedAt": "2026-10-30T10:44:08Z", "publishedAt": "2026-10-30T10:52:40.759Z", "reviewedAt": "2026-10-30T10:52:27.588Z", "expiresAt": "2026-10-30T10:44:08Z", "reviewer": "HOL Guard Security Publishing", "sources": [ { "id": "cursor-notice", "label": "Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace", "url": "https://cursor.com/blog/claude-code-extension-security-notice", "sourceType": "vendor_advisory", "observedAt": "2026-10-29T00:00:00Z" }, { "id": "opensourcemalware", "label": "OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor", "url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor", "sourceType": "research", "observedAt": "2026-10-29T00:00:00Z" }, { "id": "phorion", "label": "Phorion: Official Claude Code extension compromise security advisory", "url": "https://phorion.io/blog/offical-claude-code-vsx-compromise/", "sourceType": "research", "observedAt": "2026-10-30T00:00:00Z" }, { "id": "stepsecurity", "label": "StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor", "url": "https://www.stepsecurity.io/blog/claude-code-extension-trojanized", "sourceType": "research", "observedAt": "2026-10-30T00:00:00Z" }, { "id": "openvsx", "label": "Open VSX: Anthropic.claude-code", "url": "https://open-vsx.org/extension/Anthropic/claude-code", "sourceType": "other_primary", "observedAt": "2026-10-30T01:07:38Z" }, { "id": "thn", "label": "The Hacker News: Official Claude Code VS Code extension compromised to install persistent SSH backdoor", "url": "https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html", "sourceType": "other_primary", "observedAt": "2026-10-30T08:55:00Z" }, { "id": "hol-blog", "label": "HOL Guard operator write-up: Claude Code 2.1.313 SSH backdoor checks and cleanup", "url": "https://hol.org/blog/claude-code-2-1-313-cursor-marketplace-ssh-backdoor", "sourceType": "other_primary", "observedAt": "2026-10-30T10:44:08Z" } ], "artifacts": [ { "id": "claude-code-2-1-313", "artifactClass": "package", "ecosystem": "vscode-extension", "name": "Anthropic.claude-code (Cursor extension marketplace)", "version": "2.1.313", "defanged": false }, { "id": "svc-telemetry-key", "artifactClass": "config", "ecosystem": "ssh", "name": "Unauthorized authorized_keys entry, comment svc-telemetry", "version": "SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk", "defanged": false } ], "indicators": [ { "id": "beacon-url", "indicatorType": "url", "value": "hxxp://134.209.82[.]225:8099/beacon", "defanged": true, "confidence": "high" }, { "id": "vsix-darwin-arm64", "indicatorType": "file_hash", "value": "432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62", "defanged": false, "confidence": "high" }, { "id": "vsix-win32-x64", "indicatorType": "file_hash", "value": "3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081", "defanged": false, "confidence": "high" }, { "id": "extension-js", "indicatorType": "file_hash", "value": "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15", "defanged": false, "confidence": "high" }, { "id": "tunnel-private-key", "indicatorType": "file_hash", "value": "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278", "defanged": false, "confidence": "high" }, { "id": "package-version", "indicatorType": "package_name", "value": "Anthropic.claude-code@2.1.313", "defanged": false, "confidence": "high" } ], "timeline": [ { "id": "clean-2-1-312", "occurredAt": "2026-10-27T20:26:00Z", "eventType": "other", "summary": "Clean Anthropic.claude-code 2.1.312 published to Open VSX, per StepSecurity.", "sourceIds": [ "stepsecurity" ] }, { "id": "malicious-window-start", "occurredAt": "2026-10-29T09:27:00Z", "eventType": "first_observed", "summary": "Maliciously modified Anthropic.claude-code 2.1.313 becomes available in the Cursor VS Code extension marketplace (about 2:27am PT).", "sourceIds": [ "cursor-notice" ] }, { "id": "cursor-removal", "occurredAt": "2026-10-29T20:35:00Z", "eventType": "registry_action", "summary": "Cursor removes 2.1.313 (about 1:35pm PT), blocks distribution and shuts down its marketplace as a precaution, then audits, rotates keys, rebuilds and restores it.", "sourceIds": [ "cursor-notice" ] }, { "id": "clean-2-1-314", "occurredAt": "2026-10-30T01:07:38Z", "eventType": "vendor_action", "summary": "Clean Anthropic.claude-code 2.1.314 published to Open VSX; 2.1.313 returns not found.", "sourceIds": [ "openvsx", "stepsecurity" ] }, { "id": "hol-blog-publish", "occurredAt": "2026-10-30T10:44:08Z", "eventType": "other", "summary": "HOL Guard publishes an operator write-up with per-OS checks, Linux manual cleanup, scope notes and the Open VSX source disagreement.", "sourceIds": [ "hol-blog" ] } ], "coverage": [], "policies": [], "limitations": [ "Visual Studio Marketplace users of Claude Code in Microsoft VS Code are not listed as affected by Cursor or OpenSourceMalware.", "The @anthropic-ai/claude-code npm CLI is not affected per OpenSourceMalware.", "Cursor users who did not install or update to 2.1.313 during the 2026-10-29 window, and other Cursor marketplace extensions, are not affected per Cursor's audit.", "On most macOS and Windows hosts without admin rights the SSH enable step fails, so the attacker could not log in through the tunnel; the key, persistence and beacon still happened.", "This is a tampered marketplace package, not a vulnerability in Claude Code, and has no CVE ID.", "HOL Guard checks AI agent actions; it does not inspect IDE extension code that runs at load time and would not have blocked this loader." ], "correctionHref": "/guard/security/campaigns/claude-code-2-1-313-cursor-marketplace-ssh-backdoor/corrections" }