{"type":"bundle","id":"bundle--b0133048-3139-5f3b-9520-bf196deb68b4","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--feb73357-8630-512f-860c-c9ac93d3e292","created":"2026-10-30T10:52:40.759Z","modified":"2026-10-30T10:52:40.759Z","name":"Tampered Claude Code 2.1.313 in Cursor's extension marketplace planted a persistent SSH backdoor on developer machines","description":"Between about 09:27 and 20:35 UTC on 2026-10-29, the Cursor VS Code extension marketplace served a maliciously modified Anthropic.claude-code version 2.1.313 that Anthropic did not build. Cursor says at most 5,000 users were affected. A 66-line loader prepended to extension.js runs when the extension loads: it appends an attacker Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to tunnel@134.209.82[.]225 that retries about every 60 seconds, installs persistence (macOS LaunchAgent com.apple.sysmond, Linux @reboot crontab, Windows SysMon scheduled task or Startup sysmon.cmd), and POSTs host details, Git email and up to 40 secret-looking environment variable names to hxxp://134.209.82[.]225:8099/beacon. Cursor says enabling SSH fails without admin rights on most macOS and Windows hosts, but the key, persistence and beacon still happen. Cursor removed the version, shut down and rebuilt its marketplace, rotated keys and had the C2 server taken offline. Clean 2.1.314 was published on 2026-10-30.","aliases":["Anthropic.claude-code 2.1.313","Claude Code VS Code extension compromise","Cursor marketplace Claude Code backdoor","svc-telemetry SSH key","Claude Code extension Open VSX backdoor"],"first_seen":"2026-10-29T09:27:00Z","last_seen":"2026-10-30T10:44:08Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace","url":"https://cursor.com/blog/claude-code-extension-security-notice"},{"source_name":"OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor","url":"https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor"},{"source_name":"Phorion: Official Claude Code extension compromise security advisory","url":"https://phorion.io/blog/offical-claude-code-vsx-compromise/"},{"source_name":"StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor","url":"https://www.stepsecurity.io/blog/claude-code-extension-trojanized"},{"source_name":"Open VSX: Anthropic.claude-code","url":"https://open-vsx.org/extension/Anthropic/claude-code"},{"source_name":"The Hacker News: Official Claude Code VS Code extension compromised to install persistent SSH backdoor","url":"https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html"},{"source_name":"HOL Guard operator write-up: Claude Code 2.1.313 SSH backdoor checks and cleanup","url":"https://hol.org/blog/claude-code-2-1-313-cursor-marketplace-ssh-backdoor"}]}]}