Official Claude Code extension compromise

Claude Code for VS Code version 2.1.313 on the Cursor Marketplace contained an injected payload that ran as soon as the extension loaded, before normal extension activation and without user interaction. The code added an attacker-controlled SSH public key to the user’s authorized_keys file, then used an embedded private key to open a reverse SSH tunnel to 134.209.82.225. This arrangement could give the operator an interactive shell and file-transfer access through the victim’s SSH service. The payload also launched a detached retry loop and installed reboot persistence: a macOS LaunchAgent, a Linux cron entry, or a Windows scheduled task or Startup-folder script. Cursor removed the release, along with the corresponding NPM and VS Code versions.

On macOS, the payload’s attempt to enable Remote Login can fail: an unprivileged check returns an administrator-access error rather than “Off,” so the code skips the command to turn SSH on. The tunnel and persistence may still be installed, and access remains possible if Remote Login is already enabled or later becomes enabled. The malware also sent a host-reconnaissance beacon containing identifying details, public IP, Git email, setup status, and names - but not values - of selected environment variables that may indicate stored credentials. Organisations should identify use of version 2.1.313, investigate affected systems, and check for the planted SSH key, tunnel artifacts, persistence files, and connections to the attacker’s address.