Backdoored Claude Code Extension Drops SSH Implant — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Phorion detected a backdoor in the official Claude Code for VS Code extension 2.1.313 on the Cursor Marketplace that drops a persistent SSH implant on macOS, Linux, and Windows systems.
- Cursor removed the compromised extension version 2.1.313 from its marketplace and pulled associated NPM and VSCode packages after confirmation of the compromise.
- The backdoored extension executes an injected JavaScript payload immediately upon loading, before the legitimate extension activates, granting immediate access to local files and development environments.
- On macOS, the implant attempts to enable Remote Login via systemsetup but fails under standard user privileges due to a logic flaw where permission-denied output is misinterpreted as SSH already being enabled.
- The payload establishes a reverse SSH tunnel to 134.209.82[.]225 using an embedded private key, enabling attackers to relay connections back to the victim’s machine via dynamic port forwarding.
- Persistence mechanisms include a disguised LaunchAgent named com.apple.sysmond.plist on macOS and a config script in ~/.config/.smt on Unix-like systems, ensuring the tunnel survives reboots.
- Host reconnaissance data is beaconed back to the attacker’s server in a one-off transmission, including system and user details to aid in targeted follow-up access.
Why it matters: Developers using the compromised extension unknowingly granted attackers a pathway to long-term access to source code and internal systems. The flaw in the macOS SSH check reduced immediate risk, but machines with Remote Login already enabled—or those later configured to allow it—remained exposed, turning a trusted AI coding tool into a potential breach vector.
Ask SkimNews
