Trojanized Claude Code Extension 2.1.313 Planted an SSH Backdoor: What Is Confirmed

A tampered build of the anthropic.claude-code editor extension, version 2.1.313, adds an attacker's SSH key to the machine and opens a reverse tunnel to a remote server. OpenSourceMalware published the analysis on October 30, 2026. The first reports said the package was on the Open VSX registry and some social posts called it the official Claude VS Code extension. The researchers' own update says something narrower: Cursor contacted them and confirmed the compromise was in the Cursor Marketplace, not Open VSX, and that the Microsoft VS Code extension for Claude is not malicious.

That correction matters for how worried you should be and where to look. This post sets out what is confirmed, what is still unknown, the indicators to search for, and what to rotate. It is a security incident write-up, so we attribute each claim to its source and say plainly where the sources stop.

Quick reference: confirmed vs unconfirmed

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What the malicious code does

According to OpenSourceMalware, a 66-line JavaScript loader was prepended to the extension's main bundle, ahead of the legitimate code. It runs when the extension activates, so you do not need to open a Claude conversation, and it is not an install script. It swallows most errors so the real extension keeps working and nothing looks broken.

Reported behavior, as described in the analysis and in a CybersecurityNews summary:

• Adds an SSH key. An attacker-controlled Ed25519 public key is appended to ~/.ssh/authorized_keys with the comment svc-telemetry, with directory permissions set to 0700 and the file to 0600.
• Tries to turn SSH on. Remote Login on macOS, an SSH service on Linux, or OpenSSH Server through PowerShell on Windows. These steps can fail without sufficient permissions.
• Opens a reverse tunnel. It decodes an embedded private key to a temporary .stk_ file and connects to tunnel@134.209.82.225, forwarding the attacker's server to the victim's local port 22. It disables host-identity checks, retries after 60 seconds, and prefers autossh if present.
• Profiles the host. Hostname, username, OS, architecture, directory paths, Git email, and the names (not values) of up to 40 environment variables that look sensitive, such as cloud or credential variables. After about 1.5 seconds it sends this as JSON over unencrypted HTTP to port 8099 on the same IP.
• Persists. macOS: ~/.config/.smt, ~/.config/.smtk and a LaunchAgent named com.apple.sysmond.plist, which is not an Apple component. Linux: an @reboot cron entry. Windows: an attempted SysMon startup task running as SYSTEM, with a Startup-folder script as fallback.

The loader itself reportedly downloads no further payload. That is not comforting: a working reverse SSH tunnel means a human on the other end can do anything your account can. The sample reportedly targeted macOS on Apple Silicon, while the Linux and Windows branches are implemented code paths, not proof of successful infection on those systems.

Why the Open VSX story changed

The first alerts pointed at Open VSX, the registry used by many VS Code forks. The analysis now says Cursor told the researchers the tampered build was in its own marketplace. This is a good example of why early incident labels deserve caution. It also fits history: in August 2025, Open VSX flagged an Anthropic extension as malicious and Anthropic said it was not malware, an episode tracked in a Claude Code GitHub issue. That earlier case is unrelated to this one, and the issue was closed as not planned; it is useful mainly as a reminder that registries and vendors do disagree, and that today's version number is what counts.

The researchers add that the provenance of the directory they analyzed is not fully established and that their findings do not show a compromise of Anthropic's own release process. Anyone claiming "Anthropic was hacked" is going beyond the evidence we can see.

Is this the same as earlier extension attacks?

No evidence links them. The reports compare it to the earlier Nx Console extension compromise, which also ran injected code when a workspace opened and went after developer secrets, but say nothing shows the same attackers. The shared lesson is structural: editor extensions run with your user's full permissions, update automatically, and sit next to your SSH keys, cloud credentials and AI-agent configuration.

That is the same risk shape we covered in the LiteLLM 1.107.0 PyPI compromise and in the ProjectDiscovery backdoored Qwen demonstration, where the thing that stole credentials was a tool developers trusted. For background on what the real extension does and where it installs from, see our Claude Code VS Code extension setup guide.

How do I check whether I was affected?

Triage of a cracked box, showing steps to check a Claude Code extension SSH backdoor

Work through these on every machine where you use Cursor or another VS Code fork with the Claude extension, especially if it updated on October 29 or 30:

1. Extension version. Is anthropic.claude-code at 2.1.313, and did it come from the Cursor Marketplace?
2. SSH keys. Search ~/.ssh/authorized_keys for the comment svc-telemetry.
3. Files. Look for ~/.config/.smt, ~/.config/.smtk and a leftover .stk_ temporary file.
4. Persistence. On macOS, check LaunchAgents for com.apple.sysmond.plist. On Linux, check crontab -l for @reboot lines. On Windows, check scheduled tasks for SysMon.
5. Network. Look for SSH or autossh processes forwarding to 134.209.82.225, and for outbound traffic to that IP on ports 22 and 8099.

If any hit, treat the machine as compromised. Do not simply delete the extension.

What should I do if I find something?

OpenSourceMalware's guidance, in order:

• Disconnect the system and preserve forensic evidence before cleaning.
• Block 134.209.82.225 on ports 22 and 8099 at the network edge.
• Remove the extension and the persistence only after evidence is collected.
• Rotate credentials reachable from that account, from a known-clean device. Think SSH keys, cloud keys, Git tokens, package-registry tokens and AI provider keys.
• Review SSH, shell, process, editor, authentication and network logs for follow-on activity.
• Rebuild the host. The researchers write that rebuilding "is safer than assuming removal of known artifacts restores trust."

Small key ring with one key, illustrating credential rotation after the Claude Code extension incident

The environment-variable beacon contained names, not values, so you cannot assume secrets leaked from that step alone. But an SSH foothold can read anything your user can, so rotate anyway.

What this means for teams that run AI coding tools

For a security team, the uncomfortable part is not this one build but the pattern. AI coding assistants ship as editor extensions, CLIs and plugins, each with its own update channel, and each is attractive because it sits on a machine that holds source code, cloud credentials and agent configuration. A name like anthropic.claude-code earns instant trust, and a marketplace listing, in any editor, is only as safe as that marketplace's publishing controls.

Practical steps for a team: keep an inventory of which editors and forks developers use, since a fix in one marketplace does nothing for another; decide who may install extensions on machines with production access; and make sure someone owns watching advisories for the tools your developers rely on. Treat an incident like this as a drill: could you list, within an hour, every laptop that installed a given extension version?

How to reduce the odds of the next one

• Delay updates. Researchers quoted on X recommended the extensions.installCooldownHours setting in VS Code and forks so new extension versions are not installed immediately. Confirm that the setting exists in your editor build; we have not verified it across versions.
• Pin versions for high-privilege extensions in managed environments, and review changes before updating.
• Scope secrets. Keep long-lived cloud and registry credentials out of the shell environment your editor inherits.
• Watch agent actions. Agents and extensions that touch SSH config or start tunnels should be blocked or flagged by policy. AgentBeam, the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions like these.
• Know your token costs and sessions so odd activity stands out; our guide on Claude Code token efficiency helps establish a baseline.

What is still unknown

We do not know how the package was altered, how many people installed 2.1.313 before it was pulled, whether any victim was actually accessed, or who is responsible. We could not find an Anthropic statement. The hash values are in OpenSourceMalware's published indicators and not reproduced here, so use their page for exact detection signatures. We will update this post when Cursor, Anthropic or the researchers add facts.

Details are accurate as of October 30, 2026 and may change as the investigation continues.

Related reading

• Claude Code VS Code extension setup guide
• LiteLLM 1.107.0 PyPI compromise: what to do
• A $50 backdoored Qwen2.5-7B stole .env credentials via Codex CLI
• eMudhra CA compromise: the update-everything checklist
• Claude Code commands reference
• Claude Code token efficiency and sessions guide
• What is an agent harness?