Compromised Claude Code extension drops SSH backdoor on macOS

Security researchers at Phorion have identified a supply chain compromise affecting the official Claude Code for VS Code extension distributed via the Cursor Marketplace. The malicious versions, 2.1.312 and 2.1.313, inject a persistent Secure Shell (SSH) backdoor into macOS, Linux, and Windows environments immediately upon loading.

This incident highlights the risks inherent in developer tooling ecosystems, where extensions run with high privileges and can silently modify system configurations. Organizations using these specific versions must treat any installation as a potential breach and initiate incident response procedures.

What happened

The compromise targets developers using the Cursor editor, which hosts its own marketplace for VS Code-compatible extensions. Phorion discovered that the bundle for Claude Code versions 2.1.312 and 2.1.313 contained an injected payload. This code executes before the extension’s standard activation logic, meaning users do not need to interact with the tool for the malware to run. Cursor has since removed these versions from its marketplace.

The primary goal of the payload is to establish long-term interactive access to the victim’s machine. It achieves this by planting SSH keys and creating reverse tunnels to an attacker-controlled server at IP address 134.209.82.225. While the malware includes logic for all major desktop operating systems, the analysis focuses on macOS due to specific implementation details and bugs in the other platforms.

Because extensions operate with the permissions of the integrated development environment (IDE) and the user, the backdoor gains immediate access to local source code, files, and developer tools. This level of access allows the attacker to harvest sensitive information and maintain persistence even after the IDE is closed.

How it works

The infection begins with an immediately invoked function expression prepended to the minified extension.js file. This script imports standard Node.js modules to manipulate the file system and execute shell commands. Its first action is to ensure the ~/.ssh directory exists and append an attacker-controlled Ed25519 public key to the authorized_keys file. The key is labeled with the comment svc-telemetry, though investigators should rely on the key fingerprint rather than the comment for detection.

Next, the script attempts to enable the SSH daemon. On macOS, it checks the Remote Login status using systemsetup -getremotelogin. However, a critical bug exists here: the command requires administrator privileges to read the status. When run as a standard user, it returns an error message instead of "Off," causing the script to skip the enablement step. If Remote Login was already enabled, the backdoor works as intended; otherwise, the inbound access path remains broken until a user manually enables it.

To maintain access, the malware establishes an outbound reverse SSH tunnel to the attacker’s server. It uses an embedded private key, labeled svc-telemetry-tun, stored in the temporary directory. The tunnel forwards traffic from a dynamically allocated port on the attacker’s server to port 22 on the victim’s localhost. This allows the operator to connect back to the machine using the previously planted public key. The connection is kept alive using autossh or a retry loop, ensuring persistence across network interruptions.

Key details

• Affected versions: Claude Code for VS Code versions 2.1.312 and 2.1.313 on the Cursor Marketplace.
• Attacker infrastructure: Commands and beacons are sent to IP address 134.209.82.225 on ports 22 and 8099.
• Persistence mechanism: On macOS, the malware creates a LaunchAgent named com.apple.sysmond.plist in ~/Library/LaunchAgents to survive reboots.
• Reconnaissance data: The payload beacons host metadata, including hostname, OS, and names of environment variables matching patterns like KEY, TOKEN, or AWS.
• macOS bug: The script fails to enable Remote Login on macOS if run without admin privileges due to improper error handling of the systemsetup command.
• Detection challenge: The malware modifies authorized_keys directly via Node.js file APIs, bypassing shell-based monitoring rules that look for commands like echo or tee.

Why it matters

For software engineering teams, this incident underscores the vulnerability of the supply chain within development environments. IDE extensions are trusted components that often require broad permissions to function effectively. When such a component is compromised, it provides a direct pathway into the most sensitive assets of an organization: source code and credentials. The ability of the malware to exfiltrate the names of environment variables containing secrets allows attackers to prioritize high-value targets without initially stealing the secrets themselves.

Furthermore, the persistence mechanisms used are sophisticated enough to survive typical remediation steps. Simply uninstalling the extension does not remove the backdoor, as the malware installs independent system services and cron jobs. This means that standard package management actions are insufficient for cleanup. Security teams must understand that developer tools are now a primary attack vector, requiring the same level of scrutiny as production infrastructure.

What you can do

• Audit installed extensions: Immediately check all developer machines for Claude Code for VS Code versions 2.1.312 or 2.1.313 and uninstall them if found.
• Check for persistence artifacts: Search for ~/.config/.smt, ~/.config/.smtk, and ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS systems.
• Review SSH configurations: Inspect ~/.ssh/authorized_keys for unknown public keys, specifically those with the comment svc-telemetry or unfamiliar Ed25519 keys.
• Monitor network traffic: Look for outbound SSH connections to 134.209.82.225 or HTTP POST requests to port 8099 on that same IP.
• Analyze process logs: Use Endpoint Security Framework telemetry to detect IDE helper processes writing to SSH configuration files or creating LaunchAgents.
• Rotate credentials: If any affected machines are identified, assume compromise and rotate all secrets, API keys, and SSH keys stored on those devices.