Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
A · Strong evidence Phorion's technical teardown of a backdoored AI coding-tool extension walks through each stage of the payload with code excerpts, flags bugs in the malware, and lists file paths, key fingerprints and a sample hash that responders can check; a vendor advisory, but the evidence is verifiable.
Summary based on the full text·Original: about 12 minutes to read
In short
A 30 October 2026 security advisory from Phorion, a macOS endpoint security vendor, on a compromised build of the official Claude Code for VS Code extension distributed through the Cursor Marketplace. The injected code ran as soon as the editor loaded the extension, with no user action. It planted an attacker SSH key, opened a reverse SSH tunnel to an attacker server, installed persistence on macOS, Linux and Windows, and sent a host report listing which credential-like environment variables existed. Cursor removed both affected versions. A bug in the macOS logic often stops it from turning SSH on, but the persistence and beacon still run.
Key numbers
- 2.1.312 and 2.1.313versions of the Claude Code for VS Code extension on the Cursor Marketplace that carried the backdoor
- 60 secondssleep between reconnection attempts of the detached reverse SSH tunnel
- Up to 40environment variable names (not values) matching key, token, secret or cloud patterns sent in the beacon
- 1.5 secondsdelay after setup before the one-off host reconnaissance beacon is sent
As reported by the source.
English·Web page·opens phorion.io
What it reports
- The malicious code is an immediately invoked function prepended to the minified extension.js; the rest of the bundle looks normal. It loads Node modules for processes, files, network and crypto and runs before the extension's activate callback.
- Stage 1: appends an Ed25519 public key (comment svc-telemetry) to ~/.ssh/authorized_keys and tries to enable the local SSH server on each platform. There is no privilege escalation: on macOS and Linux it uses non-interactive sudo, which fails without cached or passwordless sudo.
- macOS bug: the unprivileged Remote Login check prints an administrator error instead of "Off", so the script skips enabling SSH. If SSH is already on, or turned on later, the backdoor works. The Windows path also has a bug that routes a PowerShell command through /bin/sh.
- Stage 2: decodes an embedded private key, writes it to a hidden temp file, and opens a reverse tunnel that forwards a server-allocated port back to the victim's port 22, retried every 60 seconds in a detached loop that survives closing the IDE.
- Stage 3: persistence through a user LaunchAgent disguised as com.apple.sysmond on macOS, an @reboot cron entry on Linux (with a bug that can wipe existing cron jobs) and a scheduled task or Startup script on Windows.
- Beacon: hostname, user, platform, directories, global Git email, public IP, stage status flags and up to 40 environment variable names matching KEY, TOKEN, SECRET, PASS, AWS or GCP, posted over plain HTTP 1.5 seconds after setup.
- Detection and response: watch for IDE helper processes writing to authorized_keys and for non-Apple processes creating com.apple.* LaunchAgents. Uninstalling the extension does not remove the backdoor; responders must kill tunnels, remove persistence and keys, and rotate credentials if SSH was enabled or a login occurred. Logins through the tunnel appear to come from localhost.
How they got it
Static analysis of the backdoored extension bundle, with code excerpts, a timeline of the advisory's own corrections (affected marketplace corrected; version 2.1.312 added from Cursor's notice), and indicators including a sample hash and two key fingerprints.
Limits
- No install counts and no evidence on how many hosts were actually accessed.
- How the attacker got the malicious build onto the marketplace is not explained.
- Analysis focuses on macOS; Linux and Windows are covered more briefly.
- Phorion sells the detection product it describes.
Why it matters for companies
AI coding extensions run with the developer's full permissions, next to source code, SSH keys and cloud credentials, and they are distributed through several marketplaces beyond the vendor's own. This case shows a trusted-name extension turned into a remote access tool through a third-party marketplace. Companies should control which marketplaces and extension versions developers can install, monitor writes to SSH configuration by editor processes, and treat any host that ran the affected versions as compromised until persistence and keys have been removed.
Summary based on the full text. Read the original for the full argument and data.Read the original on phorion.io