Claude Code VS Code Extension Found with Persistent SSH Backdoor

A malicious version of the official Claude Code extension for VS Code was discovered on the Cursor Marketplace, embedding a persistent SSH backdoor that works on macOS, Linux and Windows. The compromise highlights the risks of installing IDE extensions that run with full user privileges.

What was compromised and how was it delivered?

According to the security advisory published by Phorion, the compromised package is version 2.1.313 of the Claude Code extension. The extension is distributed through the Cursor Marketplace, which hosts add‑ons for the Cursor editor but also serves VS Code extensions. The malicious bundle contains a standard minified extension followed by an injected immediately‑invoked function expression (IIFE) that runs as soon as Node loads the file, before any of the normal activation code executes. Cursor removed the release from its store and pulled the corresponding NPM and VS Code entries after the issue was reported.

How does the backdoor gain initial access?

The payload’s first stage creates or ensures the existence of the user’s ~/.ssh directory and appends an attacker‑controlled Ed25519 public key to ~/.ssh/authorized_keys. The key is identified by the comment svc‑telemetry. Permissions are set to 0700 for the directory and 0600 for the file, matching typical SSH defaults. After the key is in place, the script attempts to start the local SSH daemon so the attacker can later log in using the matching private key.

Which platforms are affected and what implementation bugs exist?

The backdoor contains platform‑specific code paths:

• macOS – The script runs systemsetup -getremotelogin without elevation, expects the output to contain the word Off, and only then attempts to enable Remote Login with sudo -n systemsetup -setremotelogin on. When run as a regular user, systemsetup prints an administrator‑access warning and exits with status 0, causing the condition to fail. As a result, the enable‑SSH step is skipped on machines where Remote Login is disabled, leaving the planted key useless until the user manually turns SSH on.

• Linux – The code tries to start sshd or ssh via systemctl, falling back to service and init scripts. It does not include a privilege‑escalation exploit, so the command only succeeds if the user already has password‑less sudo configured.

• Windows – The script attempts to install and start the OpenSSH Server using PowerShell, but it routes the command through a helper that hard‑codes /bin/sh, which is not present on a typical Windows installation. This bug effectively prevents the Windows path from succeeding without additional manual steps.

In all three cases, the backdoor relies on the user’s existing privileges; it does not automatically gain root or SYSTEM rights.

How does the attacker maintain long‑term access?

After the SSH key is planted, the payload establishes a reverse SSH tunnel to the attacker‑controlled server at 134.209.82.225. It writes an unencrypted Ed25519 private key (comment svc‑telemetry‑tun) to the temporary directory with a filename that begins with .stk_ followed by a short MD5 hash of the hostname and home path. The tunnel uses remote port forwarding (-R *:0:localhost:22) so the attacker’s server dynamically allocates a listening port that forwards back to the victim’s local SSH daemon.

Persistence mechanisms differ by OS:

• macOS – A user LaunchAgent (com.apple.sysmond.plist) is dropped into ~/Library/LaunchAgents and loaded with launchctl. The agent runs a shell script stored in ~/.config/.smt that recreates the tunnel key and restarts the SSH connection. Because it runs in the user context, it does not require admin rights.

• Linux – The script writes the same shell script to ~/.config/.smt and adds an @reboot entry to the user’s crontab. A bug in the crontab check can overwrite existing user cron jobs on repeated executions.

• Windows – The code attempts to create a scheduled task named SysMon that runs as SYSTEM on startup. If that fails, it falls back to placing a batch file in the user’s Startup folder (%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/sysmon.cmd).

All three persistence methods keep the reverse tunnel alive even after the IDE is closed, providing the attacker with a durable foothold.

What indicators can defenders look for?

Security teams can hunt for the following artifacts, many of which are listed in the advisory:

• Files under ~/.config/.smt and ~/.config/.smtk containing embedded SSH keys.
• A LaunchAgent named com.apple.sysmond.plist in ~/Library/LaunchAgents.
• Crontab entries that reference ~/.config/.smt on Linux.
• Batch or command files named sysmon.cmd in the Windows Startup folder.
• The public key comment svc‑telemetry inside any authorized_keys file.
• Outbound SSH connections to 134.209.82.225 (or any similar IP observed in network logs).
• Repeated execution of systemsetup -getremotelogin without sudo, which may appear in process‑monitoring tools.

Collecting these I/O and process indicators can help isolate infected machines before the attacker leverages the backdoor.

What steps should developers and security teams take immediately?

1. Remove the extension – Uninstall Claude Code version 2.1.313 from VS Code and any other IDEs that may have loaded the package.
2. Rotate SSH keys – Delete the svc‑telemetry entry from ~/.ssh/authorized_keys on all affected accounts and generate new key pairs where necessary.
3. Check for persistence artifacts – Search the file system for the paths listed above and delete any malicious scripts or launch agents.
4. Audit system logs – Look for the specific systemsetup command output, SSH tunnel attempts, or scheduled‑task creation events.
5. Apply endpoint protection – Tools like Phorion’s EDR can block the known hash and flag the behavior described in the advisory.
6. Educate developers – Reinforce the policy of reviewing extensions before installation and prefer marketplace listings that are signed and vetted.

Grafy relevance – analysing suspicious extensions safely

Grafy’s Code studio (Grafy Code) lets security analysts open and explore JavaScript bundles in an isolated environment. By loading the compromised extension.js file into a sandboxed project, investigators can view the injected IIFE, examine the file‑system calls, and reproduce the SSH‑key‑dropping logic without risking their own workstation. The same workspace can be used to script a detection rule that scans other VS Code extensions for similar patterns (e.g., unexpected child_process imports or writes to ~/.ssh). For teams that need to read the full advisory PDF or related research, Grafy’s Reader app provides searchable AI‑enhanced navigation, but the direct code inspection is best done in Grafy Code.

For more context on securing Claude‑related tooling, see the earlier Grafy News story on custom hooks for safer AI coding: Claude Code Mods Cut Overhead 100× with Custom Hooks for Safer AI Coding. Additional insights into supply‑chain threats in the AI space are covered in the Mistral cybersecurity release: Mistral releases open‑weight trillion‑parameter model for cybersecurity.

Source: https://phorion.io/blog/offical-claude-code-vsx-compromise/

Frequently asked questions

How can I tell if my VS Code installation is still compromised?

Search for the backdoor’s file paths (~/.config/.smt*, com.apple.sysmond.plist, sysmon.cmd) and for the public‑key comment svc‑telemetry in authorized_keys. Remove any matches and reinstall the extension from a trusted source.

Does the macOS bug mean the backdoor is ineffective on my Mac?

If Remote Login is already disabled, the script skips the step that would enable SSH, leaving the planted key unusable until the user manually turns on Remote Login. However, the attacker can still attempt to use the reverse tunnel, and the persistence files remain on disk, so remediation is still required.

Can Grafy help automate detection of similar malicious extensions?

Yes. Using Grafy Code you can create a project that parses extension bundles and flags unexpected use of Node.js modules such as child_process combined with file writes to ~/.ssh. The same workflow can be exported as a script for continuous integration pipelines.

---

Source: Hacker News — front page — Backdoor in Claude Code for VS Code extension on the Cursor Marketplace