Claude Code Extension Compromise: Security Advisory and Technical Analysis

Incident Overview

A compromised version of the official Claude Code VS Code extension (version 2.1.313) was distributed through the Cursor Marketplace, resulting in a persistent security breach for affected users. The malicious extension bundle contained a backdoor that established a reverse SSH tunnel, allowing unauthorized remote access to the victim's machine. Cursor has since removed the affected version from its marketplace, and users are advised to perform a thorough security audit of their environments.

Technical Analysis of the Backdoor

The malicious payload is executed via an injected immediately invoked function expression (IIFE) within the extension.js file. This code runs as soon as the extension module is loaded, granting it access to the user's environment before the official extension logic initializes. The attack follows a multi-stage process to ensure persistence and remote access.

SSH Access and Persistence

The malware attempts to gain long-term interactive access by modifying the victim's SSH configuration:

• Credential Injection: It appends an attacker-controlled Ed25519 public key (commented svc-telemetry) to the ~/.ssh/authorized_keys file.
• Reverse Tunneling: The script establishes an outbound SSH connection to an attacker-controlled server (134.209.82.225) using remote port forwarding (-R *:0:localhost:22). This allows the attacker to reach the victim's machine through the established tunnel.
• Persistence Mechanisms: The backdoor ensures survival across reboots by installing platform-specific persistence:
  • macOS: Installs a LaunchAgent (~/Library/LaunchAgents/com.apple.sysmond.plist) that executes a hidden shell script.
  • Linux: Adds an @reboot entry to the user's crontab.
  • Windows: Attempts to create a SYSTEM scheduled task or drops a script into the user’s Startup folder.

Host Reconnaissance

Before finalizing the tunnel, the malware beacons host information back to the attacker. This includes the hostname, username, OS details, and a list of environment variable names matching patterns like KEY, TOKEN, SECRET, PASS, AWS, or GCP. By collecting these variable names, the attacker can prioritize high-value targets based on the presence of sensitive cloud or API credentials.

Detection and Remediation

Security teams should not rely solely on the removal of the extension to remediate this threat, as the backdoor components persist independently.

Remediation Steps

1. Kill Active Processes: Terminate any running ssh or autossh processes connecting to 134.209.82.225.
2. Remove Persistence: Delete the malicious LaunchAgent on macOS, the crontab entry on Linux, or the scheduled task/startup script on Windows. Remove the associated hidden files (e.g., ~/.config/.smt and ~/.config/.smtk).
3. Clean SSH Keys: Remove the svc-telemetry public key from ~/.ssh/authorized_keys.
4. Rotate Credentials: Given the potential for unauthorized access, rotate any API keys, tokens, or secrets that were present in the environment variables of the affected machine.

Detection Signals

• File Integrity: Monitor for IDE helper processes (e.g., Code Helper) modifying ~/.ssh/authorized_keys.
• Process Telemetry: Look for ssh or autossh processes utilizing identity files from /tmp/ or ~/.config/ with remote port forwarding flags.
• LaunchAgent Anomalies: Flag non-Apple processes that create or modify files in ~/Library/LaunchAgents/ with com.apple.* labels.

Community Insights

Discussion within the security and developer community has highlighted concerns regarding the trust model of editor marketplaces. Commenters noted that the incident underscores the risks of "marketplace proxies" and the lack of enforced package integrity or checksum verification for extensions.

"This kind of thing is only going to get worse. People assume other devs are 'like them' but state actors are likely using AI at this point to run agents non-stop to break security by making dev tools or contributing to open source." — Hacker News User

Users are encouraged to verify their status by checking their authorized_keys file for the svc-telemetry comment string, as this remains the most reliable indicator of compromise.