Backdoored Claude Code extension on Cursor dropped SSH keys on laptops

Any developer who installed the Claude Code extension on Cursor this week needs to check the version. Phorion, a macOS endpoint security firm, found a backdoor in the official Claude Code for VS Code extension. The build is on the Cursor Marketplace, and the compromised version is 2.1.313. The backdoor plants a persistent SSH backdoor on macOS, Linux and Windows. Cursor has removed the release. The matching 2.1.313 build was pulled from NPM and the VSCode registry too.

What the backdoor does

The compromised extension.js runs when Node loads the file. It runs before the extension's activate callback. The user never interacts with it for the payload to fire. The script adds an attacker Ed25519 public key to ~/.ssh/authorized_keys. The key comment is svc-telemetry. The script then tries to enable the local SSH daemon. On Linux it uses systemctl. On macOS it tries sudo -n systemsetup -setremotelogin on. On Windows it tries to install OpenSSH Server with PowerShell. None of these use a privilege escalation exploit. The SSH enable step can fail on a locked-down host.

Next the script opens an outbound reverse SSH tunnel. The target is 134.209.82.225 on port 22. It uses a second embedded key, with the comment svc-telemetry-tun, to log in to the attacker server. The tunnel asks the server to pick a port. Any traffic to that port is forwarded back to port 22 on the victim machine. The operator then connects to that port on their own server. That puts them straight into the victim's local SSH, using the first key.

The persistence that survives uninstall

Removing the extension does not remove the backdoor. The script writes a shell script to ~/.config/.smt and a tunnel key to ~/.config/.smtk. On macOS it adds a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist. The file is disguised as an Apple service. On Linux it adds an @reboot crontab entry. On Windows it tries to create a scheduled task called SysMon running as SYSTEM. If that fails it drops a script in the user's Startup folder.

The payload also sends one beacon to 134.209.82.225:8099/beacon. The beacon carries the hostname, username, OS, home directory, current working directory, global git email and public IP. It includes up to 40 environment variable names, not values, that match the regex KEY|TOKEN|SECRET|PASS|AWS|GCP. Phorion says the beacon tells the operator which hosts hold credentials worth coming back for.

A bug on macOS that blunts the SSH step

On macOS the SSH enable step often fails. The script runs systemsetup -getremotelogin without sudo. On a standard user account, that command prints an admin-access error and exits 0. The script tests the output for Off, so the test fails and the enable step is skipped. On a Mac without SSH already running, the inbound tunnel hits a closed port. Phorion says this is not a defence to rely on. Any user who later turns on Remote Login opens the path.

What to do on an affected machine

Phorion lists the clean-up steps in its advisory. Kill the retry loop. Kill any ssh or autossh process connecting to 134.209.82.225. Delete ~/.config/.smt, ~/.config/.smtk, and any /tmp/.stk_* file. Remove the com.apple.sysmond.plist LaunchAgent on macOS. On Linux, remove the @reboot cron entry. On Windows, remove the SysMon scheduled task and the Startup script. Delete the svc-telemetry public key from ~/.ssh/authorized_keys. Rotate any credentials the account could reach. Pay special attention to tokens that match the beacon's regex.

A team that lets engineers install editor extensions on their own has a real cost here. An IDE extension runs with the user's permissions. A backdoor in one reaches the source tree, the SSH keys and every token in the shell. The lesson is to log the version of every editor extension in use.

Source

Phorion security advisory on the Claude Code for VS Code extension by Calum Hall.