SSH Backdoor Found in Claude Code for VS Code: Build 2.1.313 on Cursor Marketplace

⚡ The Gist in 5 Seconds

• Phorion found a baked-in SSH backdoor in the Claude Code for VS Code bundle on Cursor Marketplace — build 2.1.313.
• The code fires at module load, before activate: an Ed25519 key is appended to ~/.ssh/authorized_keys with 0700/0600 permissions.
• Cursor pulled the release from the marketplace and removed 2.1.313 from NPM and the VS Code registry; on macOS, a bug in the malware itself breaks the way in.

🔍 What Happened

Phorion published a breakdown of the backdoor in the official Claude Code extension for VS Code — the very bundle hosted on Cursor Marketplace. The build number is 2.1.313. An IIFE prefix was glued into the minified extension.js: it pulls in child_process, fs, os, path, http, and crypto and fires the moment Node loads the file, before the regular activate even runs. No clicks needed — the extension installs, and the payload is already working.

The mechanics from there are simple, and therefore unpleasant. The code creates ~/.ssh, appends the attacker's Ed25519 public key to authorized_keys with the comment svc-telemetry, sets 0700 on the directory and 0600 on the file. It then tries to bring up the daemon: on Linux, systemctl for sshd/ssh with a fallback to service and /etc/init.d/; on Windows, installing and starting OpenSSH Server via PowerShell; on macOS, checking Remote Login and sudo -n systemsetup -setremotelogin on. Key presence is checked by the svc-telemetry string rather than the key itself — when hunting, it's better to compare fingerprints.

On macOS, the logic trips over itself. Under a regular user, systemsetup -getremotelogin prints an access error and exits with status 0 instead of Off. The script only enables SSH on an exact match with Off — so the step is simply skipped. The key and persistence remain in place, though, and host reconnaissance still goes to the operator.

🧠 Our Take

Our assessment: this story isn't about Claude Code as a product, it's about the supply chain. Extensions run with IDE privileges and user privileges — meaning they get files, source code, the terminal, and keys right after module load. Agentic coding extensions request exactly this access by nature, and there's no way to tell normal behavior from a foreign implant by eye.

What it changes: the 'install from the marketplace and forget' habit is no longer free. For a team, that's hours of incident response: sweep the fleet, check authorized_keys, revoke keys, reissue tokens. For platforms, it's a question of moderation and bundle signing, not just install counts.

Who wins: Phorion — the writeup hit the HN top, and in the post itself they casually mention taking first place in independent EDR evaluations, so the marketing here is free. Who loses: Cursor as the marketplace host, and the Claude Code brand, which suspicion lands on first.

⚠️ What We Don't Know

Weak spots abound. It's unclear how exactly the malicious code got into the bundle, who authored it, and how many installs are affected. There's not a word about confirmed compromises or whether anyone reviewed the build before publication. The post contains no reaction from Cursor or Anthropic — the release takedown is described per Phorion's account. There's a single source, and it's a vendor blog with an obvious commercial interest.