Backdoor Found in Claude Code VS Code Extension on Cursor Marketplace

#TL;DR

Phorion discovered that versions 2.1.312 and 2.1.313 of the official Claude Code extension for VS Code, distributed through the Cursor Marketplace, contain a hidden payload that drops an SSH key into ~/.ssh/authorized_keys and opens a reverse SSH tunnel to an attacker‑controlled server. The implant runs as soon as the extension’s JavaScript bundle is loaded, needs no user interaction, and attempts to enable the system SSH daemon on macOS, Linux, and Windows. Cursor has removed the affected versions, but any organization that installed them should assume compromise, audit for the artifacts, and rotate keys immediately.

#What’s new

The backdoor is not a “feature” of Claude Code; it is a supply‑chain compromise of the extension bundle. Because VS Code extensions execute with the same privileges as the user running the IDE, the payload gains immediate access to the developer’s environment.

#How it compares

In short, the backdoor behaves like a classic supply‑chain implant: it piggybacks on a trusted developer tool, executes silently, and establishes a covert command‑and‑control channel. The only “defence” built into the payload is a bug in the macOS SSH enable check, which may unintentionally reduce exposure on systems where Remote Login is disabled. That bug should not be relied upon as a mitigation.

#How to try it (detecting the compromise)

Below is a minimal Node.js script you can run on any workstation to check for the known indicators of compromise (IOCs). It does not install anything; it only reads files and enumerates processes.

// detect-claude-backdoor.js
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execSync } = require('child_process');

function hasBackdoorKey() {
  const authFile = path.join(os.homedir(), '.ssh', 'authorized_keys');
  if (!fs.existsSync(authFile)) return false;
  const content = fs.readFileSync(authFile, 'utf8');
  return /svc-telemetry/.test(content);
}

function hasTunnelKey() {
  const tmpDir = os.tmpdir();
  const files = fs.readdirSync(tmpDir);
  return files.some(f => f.startsWith('.stk_'));
}

function hasOutboundSSH() {
  try {
    const out = execSync('ps -eo pid,command | grep "[s]sh -N -R"', { encoding: 'utf8' });
    return out.includes('134.209.82.225');
  } catch (_) {
    return false;
  }
}

console.log('=== Claude Code backdoor scan ===');
console.log('Authorized‑keys contains backdoor key:', hasBackdoorKey());
console.log('Temporary tunnel key file present:', hasTunnelKey());
console.log('Outbound reverse‑SSH process running:', hasOutboundSSH());

How to use

node detect-claude-backdoor.js

If any of the three checks return true, the host is likely compromised and you should:

1. Terminate the offending SSH process (kill <pid>).
2. Remove the malicious key from ~/.ssh/authorized_keys.
3. Delete any .stk_* files from the temporary directory.
4. Rotate all SSH keys that may have been used on the machine.
5. Re‑install the Claude Code extension from a trusted source (e.g., the official Anthropic VS Code marketplace, not the Cursor Marketplace).

For large fleets, embed the script in a CI/CD or endpoint‑management tool and run it across all developer workstations.

#Limitations and open questions

Until these questions are answered, the safest stance is to treat any installation of the affected versions as a breach and to assume that the attacker can reach the host at any time.

#Key takeaways

#FAQ

Q1. Is the backdoor limited to Claude Code users, or could any VS Code extension be compromised in the same way?
A: The malicious code was injected only into the Claude Code bundle distributed via the Cursor Marketplace. However, the attack vector—tampering with the extension package before it reaches the marketplace—is generic. Any VS Code extension that bypasses code‑signing checks could be used for a similar supply‑chain implant.

Q2. Do I need admin rights on my machine to be affected?
A: No. The payload runs as the current user, which is sufficient to write to ~/.ssh/authorized_keys and launch an outbound SSH process. Enabling the local SSH daemon may fail without sudo, but the backdoor still works if Remote Login is already on or later enabled.

Q3. Can I still use Claude Code safely?
A: Yes, but install it from a trusted source (e.g., the official Anthropic VS Code marketplace) and verify the package checksum. Avoid the Cursor Marketplace until it implements stricter security controls.