Trojanized Claude Code extension delivers persistent SSH backdoor to developer machines
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines - StepSecurity
On October 29, 2026, the Claude Code VS Code extension anthropic.claude-code 2.1.313 was implanted with a malicious loader in the Open-VSX registry and, via mirror synchronization, entered the Cursor extension marketplace; according to Cursor's statistics, at most 5000 users received that version within a window of about 11 hours. StepSecurity confirmed through sandbox analysis that when this version loads, it writes the attacker's SSH key, installs persistence for different operating systems, establishes a reverse SSH tunnel to a C2 (134.209.82.225), and sends host reconnaissance information back over plaintext HTTP. According to Cursor's notice, this malicious version was not developed or published by Anthropic, and how it entered the registry has not yet been publicly determined; Cursor took down the version and rotated keys on October 29, a clean 2.1.314 was released on October 30, and the C2 has been taken offline.
The article provides a complete attack timeline, an IOC list, and item-by-item cleanup steps, so developers who installed 2.1.313 can use it to check for persistence and rotate credentials.