EN PT-BR
← Voltar ao feed
high technology software development

Tampered Claude Code VS Code extension v2.1.313 planted persistent SSH backdoor on developer machines via Cursor/Open VSX

1 fonte(s) · 1 atualização(ões) · publicado 30/10/2026 08:15 · coletado há 1 hora

A tampered build of the Claude Code extension (version 2.1.313) for VS Code-compatible editors planted a persistent SSH backdoor on developer machines, according to macOS security firm Phorion. The package was spotted on Open VSX, and Cursor says it was live in its own VS Code extension marketplace for about 11 hours on October 29, 2026, affecting at most 5,000 users. Cursor stated the build was not developed by Anthropic and that no other versions or official distribution were affected. A later update from Manifold Security's Ax Sharma disputes reports that the Open VSX version was compromised, saying the poisoned listing was in Cursor's marketplace. Uninstalling the extension does not remove the backdoor.

Detalhes técnicos

  • An injected IIFE is prepended to the minified extension.js bundle and runs on Node load, before the extension's activate callback, with no user interaction needed.
  • It adds the attacker's SSH key (labelled svc-telemetry) to the user's authorized keys and opens an outbound SSH tunnel to the attacker's server, retrying about every 60 seconds; the tunnel survives closing the editor.
  • Persistence: macOS startup file with an Apple-style name, Linux cron entry at reboot, Windows scheduled task SysMon with Startup folder fallback.
  • Reconnaissance sent to the operator: hostname, username, OS, home and working directories, Git email, public IP, and names (not values) of up to 40 environment variables resembling keys, tokens, passwords or AWS/GCP credentials.
  • The key works only if the SSH service is running. On macOS a faulty Remote Login check (run without admin rights) often skips enabling SSH, but the backdoor works if Remote Login is already enabled or enabled later. Cursor says enabling SSH needs admin rights the extension lacks on most Mac and Windows hosts.
  • Cursor worked with the attacker server's cloud provider to take it offline, stopping the tunnel and data reports.

Remediação

  • Check the SSH authorized keys file for an entry labelled svc-telemetry if version 2.1.313 was installed or updated to.
  • Use the cleanup scripts and commands published by Cursor for macOS and Windows; both companies shared IOCs. The payload drops standalone scripts, so uninstalling is not enough.
  • Isolate affected machines, consider a rebuild, and rotate credentials and sessions reachable from them using a trusted system.
  • Review SSH logs for localhost logins using the svc-telemetry key to see whether the operator connected.
  • Cursor shut down, audited, rotated keys and rebuilt its marketplace, and found no other tampered extensions.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 30/10/2026 08:15 · coletado 01/11 22:21 primeiro registro

    Tampered Claude Code VS Code extension v2.1.313 planted persistent SSH backdoor on developer machines via Cursor/Open VSX

    ler a análise desta fonte

    A tampered build of the Claude Code extension (version 2.1.313) for VS Code-compatible editors planted a persistent SSH backdoor on developer machines, according to macOS security firm Phorion. The package was spotted on Open VSX, and Cursor says it was live in its own VS Code extension marketplace for about 11 hours on October 29, 2026, affecting at most 5,000 users. Cursor stated the build was not developed by Anthropic and that no other versions or official distribution were affected. A later update from Manifold Security's Ax Sharma disputes reports that the Open VSX version was compromised, saying the poisoned listing was in Cursor's marketplace. Uninstalling the extension does not remove the backdoor.

    Technical Details

    • An injected IIFE is prepended to the minified extension.js bundle and runs on Node load, before the extension's activate callback, with no user interaction needed.
    • It adds the attacker's SSH key (labelled svc-telemetry) to the user's authorized keys and opens an outbound SSH tunnel to the attacker's server, retrying about every 60 seconds; the tunnel survives closing the editor.
    • Persistence: macOS startup file with an Apple-style name, Linux cron entry at reboot, Windows scheduled task SysMon with Startup folder fallback.
    • Reconnaissance sent to the operator: hostname, username, OS, home and working directories, Git email, public IP, and names (not values) of up to 40 environment variables resembling keys, tokens, passwords or AWS/GCP credentials.
    • The key works only if the SSH service is running. On macOS a faulty Remote Login check (run without admin rights) often skips enabling SSH, but the backdoor works if Remote Login is already enabled or enabled later. Cursor says enabling SSH needs admin rights the extension lacks on most Mac and Windows hosts.
    • Cursor worked with the attacker server's cloud provider to take it offline, stopping the tunnel and data reports.

    Remediation

    • Check the SSH authorized keys file for an entry labelled svc-telemetry if version 2.1.313 was installed or updated to.
    • Use the cleanup scripts and commands published by Cursor for macOS and Windows; both companies shared IOCs. The payload drops standalone scripts, so uninstalling is not enough.
    • Isolate affected machines, consider a rebuild, and rotate credentials and sessions reachable from them using a trusted system.
    • Review SSH logs for localhost logins using the svc-telemetry key to see whether the operator connected.
    • Cursor shut down, audited, rotated keys and rebuilt its marketplace, and found no other tampered extensions.