Microsoft warns that trojanized Claude Code extensions attempt to implant persistent SSH backdoors
Microsoft Warns of Trojanized Claude Code Extension Planting Persistent SSH Backdoor
Microsoft warns that trojanized Claude Code extensions distributed through the Cursor marketplace attempted to install persistent SSH backdoors on developer workstations, involving versions anthropic.claude-code 2.1.312 and 2.1.313. The malicious JavaScript executes before the extension's normal initialization, collects information such as hostname, username and global Git email, appends a built-in Ed25519 public key to authorized_keys and establishes a reverse SSH tunnel, persisting on macOS, Linux and Windows via a LaunchAgent, a crontab @reboot entry and a scheduled task respectively; the relevant files are located outside the extension directory, so uninstalling or updating the extension will not remove them.
The article compiles the persistence paths and IOC lists of malicious extensions across the three major systems, so developers can use them to check whether their machines are affected and clean up residual backdoors that remain even after uninstalling the extension.