> ## Content Index > Fetch the complete content index at: https://blog.harshkohli.com/llms.txt > Use this file to discover other available public pages before exploring further. # Claude Code Extension Backdoor: How to Check and Clean Up - URL: https://blog.harshkohli.com/claude-code-extension-backdoor-check-fix/ - Published: 2026-10-30T09:41:38.000Z - Updated: 2026-11-11T10:06:58.000Z - Description: A fake Claude Code 2.1.313 build in Cursor's marketplace planted an SSH backdoor. Here's how to check your machine, remove it and rotate your keys. - Author: Harsh Kohli - Tags: How-To, Software, AI, Fixes *Updated 30 October 2026\. Checked against Cursor's security notice, the OpenSourceMalware and Phorion write-ups, and the live Open VSX and VS Code Marketplace listings today.* The short version: if you use **Cursor** and your Claude Code extension updated to **version 2.1.313** on 29 October 2026, assume that machine got a backdoor. Run `grep svc-telemetry ~/.ssh/authorized_keys` (macOS or Linux) or the PowerShell check further down (Windows). If it finds the key, delete that line, remove the persistence files and scheduled job listed below, update the extension to 2.1.314 and rotate every credential that machine could reach. If you use plain VS Code, VSCodium or the Claude Code CLI from npm, the researchers who took the payload apart say those copies were clean. A lot of the early posts blamed Open VSX, so plenty of people are worried about the wrong editor. Below is what actually happened, who is affected, and every check and cleanup step in order. **Jump to:** - [What happened](#what-happened) - [Who is affected (and who isn't)](#who-is-affected-and-who-isnt) - [Step 1: Check which version you had](#step-1-check-which-version-you-had) - [Step 2: Look for the svc-telemetry SSH key](#step-2-look-for-the-svc-telemetry-ssh-key) - [Step 3: Look for the persistence files](#step-3-look-for-the-persistence-files) - [Step 4: Disconnect and remove the backdoor](#step-4-disconnect-and-remove-the-backdoor) - [Step 5: Rotate your credentials](#step-5-rotate-your-credentials) - [Step 6: Update to 2.1.314](#step-6-update-to-21314) - [Indicators of compromise (table)](#indicators-of-compromise) - [FAQ](#faq) ## What happened On 29 October 2026, between about 2:27 am and 1:35 pm Pacific time (09:27 to 20:35 UTC), a tampered build of Anthropic's **Claude Code for VS Code** extension, labelled `Anthropic.claude-code` 2.1.313, sat in **Cursor's** own VS Code extension marketplace. Cursor says Anthropic didn't build it, at most 5,000 users got it, and it will contact them directly. The package looked exactly like the real thing. The bundled Claude binary was the official one. The only change, according to [OpenSourceMalware's analysis](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor?ref=blog.harshkohli.com), was a 66-line loader stuck to the top of `extension.js`. It runs the moment the editor loads the extension. You didn't have to open Claude or type a prompt. Once loaded, it: - collected your hostname, username, OS, CPU type, home and working folder paths, your global Git email, your public IP, and the *names* (not values) of up to 40 environment variables containing words like KEY, TOKEN, SECRET, PASS, AWS or GCP - added an attacker's SSH public key, labelled `svc-telemetry`, to your `authorized_keys` file - tried to switch on your machine's SSH server and open a reverse SSH tunnel to `134.209.82.225` - installed a LaunchAgent (macOS), a scheduled task (Windows) or a crontab entry (Linux) that retries the tunnel about every 60 seconds - sent all of that to `http://134.209.82.225:8099/beacon` There's some good news. Turning on SSH needs admin rights, and the malware had bugs: [Phorion found](https://phorion.io/blog/offical-claude-code-vsx-compromise/?ref=blog.harshkohli.com) that on macOS, the Remote Login check returns an error for normal users, so the "enable SSH" step gets skipped. Cursor says that unless you ran Cursor as administrator, the attacker most likely couldn't log in through the tunnel. Cursor also got the attacker's server taken offline. But the key, the persistence scripts and the beacon still landed on your disk, so clean up anyway. Cursor pulled the version, shut its whole extension marketplace down, checked that no other extensions had been touched, rotated its keys, rebuilt the marketplace and brought it back. The full notice is on the [Cursor blog](https://cursor.com/blog/claude-code-extension-security-notice?ref=blog.harshkohli.com). Anthropic hadn't said anything publicly when I checked this afternoon. ## Who is affected (and who isn't) - **Affected:** Cursor users who installed or auto-updated Claude Code to 2.1.313 from Cursor's marketplace during that window on 29 October. - **Not affected, per OpenSourceMalware:** the `@anthropic-ai/claude-code` npm package (the CLI), the Open VSX listing used by VSCodium and similar editors, and the Microsoft VS Code Marketplace listing. I looked at both public listings myself. The VS Code Marketplace version history jumps from 2.1.312 straight to 2.1.314, and the Open VSX API lists 2.1.309 to 2.1.312 and then 2.1.314\. There's no 2.1.313 on either one now. ![VS Code Marketplace version history for Claude Code for VS Code showing version 2.1.314 followed by 2.1.312 with no 2.1.313](https://blog.harshkohli.com/content/images/2026/10/claude-code-vscode-marketplace-version-history.webp) The Microsoft listing's version history today: 2.1.314, then 2.1.312\. Screenshot: Visual Studio Marketplace (Microsoft), extension by Anthropic. If you use more than one editor on the same machine, check the Cursor one. That's the only copy that matters here. ## Step 1: Check which version you had Start by looking at Cursor's extensions folder. A leftover 2.1.313 folder tells you it was installed at some point. If the folder's gone, that doesn't clear you, because auto-update may already have replaced it, so carry on to Step 2 either way. **macOS or Linux:** ``` ls -d ~/.cursor/extensions/anthropic.claude-code-* ``` **Windows (PowerShell):** ``` Get-ChildItem "$HOME\.cursor\extensions" -Filter "anthropic.claude-code-*" ``` The bad build shows up as a folder like `anthropic.claude-code-2.1.313-darwin-arm64` or `anthropic.claude-code-2.1.313-win32-x64`. If you still have it, its `extension.js` should have the SHA-256 hash `ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`. Don't delete it yet if your company's security team will want to see it. ## Step 2: Look for the svc-telemetry SSH key This is the check Cursor recommends, and it's the one that actually answers "was I hit?" ![Cursor security notice section titled Check whether you are impacted with grep and PowerShell commands for the svc-telemetry key](https://blog.harshkohli.com/content/images/2026/10/cursor-claude-code-check-impacted.webp) Cursor's own check, from its security notice. Screenshot: Cursor. **macOS or Linux:** ``` grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted" ``` **Windows (PowerShell):** ``` $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ } if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" } ``` If you want to be sure it's the same key and not a coincidence, list the fingerprints of every key in the file: ``` ssh-keygen -lf ~/.ssh/authorized_keys ``` The attacker's key is `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk`. I ran the published key through `ssh-keygen` on a Linux box and got that exact fingerprint, so it's a reliable match. Also look for any key you don't recognise while you're in there. ## Step 3: Look for the persistence files Even if Step 2 came back clean, spend a minute on this. These are the files and jobs the loader drops, taken from the Cursor, OpenSourceMalware and Phorion write-ups. **macOS:** ``` ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist "$TMPDIR"/.stk_* 2>/dev/null launchctl list | grep sysmond ``` Apple doesn't ship anything called `com.apple.sysmond` in your user LaunchAgents folder. The name is there to look boring. **Linux:** ``` ls -la ~/.config/.smt ~/.config/.smtk /tmp/.stk_* 2>/dev/null crontab -l | grep -n "smt" ``` One Linux catch from Phorion: the way the malware writes its `@reboot` line can wipe the crontab entries you already had. If your own cron jobs have gone missing, that's probably why. **Windows (PowerShell):** ``` Get-ChildItem "$HOME\.config\smt.cmd", "$HOME\.config\smtk", "$env:TEMP\.stk_*" -Force -ErrorAction SilentlyContinue Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd" -ErrorAction SilentlyContinue ``` Finally, look for a running tunnel. On macOS or Linux, `ps aux | grep "localhost:22"` will show an `ssh -N -R` or `autossh` process if one is alive. ## Step 4: Disconnect and remove the backdoor If anything turned up in Steps 2 or 3, treat the machine as compromised. 1. **Cut it off first.** Pull it off the network or block `134.209.82.225` on ports 22 and 8099 at your firewall. If it's a work laptop, tell your security team now and let them decide whether to keep evidence first. 2. **Delete the key.** On macOS or Linux, this removes only the attacker's line and keeps a backup: `sed -i.bak '/svc-telemetry/d' ~/.ssh/authorized_keys`. On Windows, open the file in Notepad and delete the line ending in `svc-telemetry`. 3. **Remove persistence.** macOS: `launchctl unload ~/Library/LaunchAgents/com.apple.sysmond.plist`, then delete that plist and the `~/.config/.smt`, `.smtk` and `.stk_*` files. Linux: delete the line from `crontab -e` and the same files. Windows: `Unregister-ScheduledTask -TaskName SysMon` from an admin PowerShell, then delete `sysmon.cmd` from Startup and the `smt.cmd`, `smtk` and `.stk_*` files. 4. **Kill the tunnel** if one was running, then reboot and repeat Steps 2 and 3 to make sure nothing came back. 5. **Turn SSH back off** if you never used it: System Settings > General > Sharing > Remote Login on a Mac, or the OpenSSH Server service on Windows. Cursor has also published remediation scripts for macOS and Windows on its notice page. Read through any script before you run it. And as Cursor puts it, uninstalling the extension isn't enough, because the payload leaves standalone scripts behind. If this is a machine with production access, a clean reinstall is the safer call. ## Step 5: Rotate your credentials The beacon only sent variable *names*, not values. But anyone who got in through the backdoor could have read anything your user account could. So if you found the key, rotate from a different, trusted device: - cloud keys (AWS, GCP, Azure) and API keys for AI providers like Anthropic or OpenAI - GitHub or GitLab personal access tokens and SSH keys, and the deploy keys on repos you work on - anything in `.env` files in the projects you had open - browser sessions and password manager sessions on that machine We went through the same routine after the [Railway breach](https://blog.harshkohli.com/railway-breach-rotate-api-keys/), and it's the same list here. Start with whatever can spend money or push code. ## Step 6: Update to 2.1.314 Cursor asks everyone to move to 2.1.314\. Open the Extensions view (**Ctrl+Shift+X** or **Cmd+Shift+X**), find Claude Code for VS Code and check that the version says 2.1.314 or later. If it's stuck, uninstall it, restart Cursor and install it again from the marketplace. It's a good moment to think about auto-updates for extensions in general. This one got in because an editor trusted a marketplace update without a second look. AI coding tools are a favourite target right now; we saw the same pattern with [the AGENTS.md agent hijack](https://blog.harshkohli.com/agents-md-downloads-folder-ai-agent-hijack/) and the [LiteLLM attack](https://blog.harshkohli.com/litellm-attack-leaked-master-key/). ## Indicators of compromise | Type | Indicator | Where | | ---------- | ----------------------------------------------------------------------------------------- | --------------------------- | | Extension | Anthropic.claude-code 2.1.313 | Cursor marketplace only | | File hash | extension.js SHA-256 ecb58cb2...3ab6bf15 | Extension folder | | IP address | 134.209.82.225 (SSH 22, HTTP 8099 /beacon) | Network logs | | SSH key | Comment svc-telemetry, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk | authorized\_keys | | Tunnel key | Comment svc-telemetry-tun, SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ | Dropped key file | | macOS | \~/Library/LaunchAgents/com.apple.sysmond.plist, \~/.config/.smt, .smtk, $TMPDIR/.stk\_\* | User folder | | Linux | @reboot crontab entry, \~/.config/.smt, .smtk | User crontab | | Windows | Scheduled task SysMon, Startup\\sysmon.cmd, %USERPROFILE%\\.config\\smt.cmd | Task Scheduler, user folder | | Process | ssh -N -R '\*:0:localhost:22' or autossh -M 0 | Running processes | Sources: [Cursor security notice](https://cursor.com/blog/claude-code-extension-security-notice?ref=blog.harshkohli.com), [OpenSourceMalware](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor?ref=blog.harshkohli.com), [Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/?ref=blog.harshkohli.com). If you think you were hit and need help, Cursor's contact is security@cursor.com. **Related guides:** next stop is my guide to [checking your PC after the NIKKE launcher malware](https://blog.harshkohli.com/nikke-pc-launcher-malware-check-clean/). After that, see [secrets leaking from Claude Code's settings.local.json](https://blog.harshkohli.com/claude-code-settings-local-json-secrets/) and [Discord messages showing up in Google](https://blog.harshkohli.com/discord-messages-google-search-guide/) if either matches what you're seeing. If you run agents through Conductor, note that [its cloud shuts down on 20 November](https://blog.harshkohli.com/meta-conductor-cloud-shutdown/). ## FAQ ### Was the official Claude Code extension hacked? Not the one Anthropic publishes to Microsoft's VS Code Marketplace, as far as anyone has shown. The bad 2.1.313 build appeared only in Cursor's marketplace, and Cursor says Anthropic didn't build it. How it got there hasn't been explained publicly yet. ### I use VS Code, VSCodium or Windsurf. Do I need to do anything? OpenSourceMalware's updated analysis says the Microsoft and Open VSX listings were clean, and neither shows a 2.1.313 today. Running the Step 2 check takes five seconds, though, so it's worth doing if you have Cursor installed anywhere. ### Is the Claude Code CLI from npm safe? Yes, according to OpenSourceMalware, the `@anthropic-ai/claude-code` npm package wasn't affected. It's a separate install from the editor extension. ### Can the attacker still get into my machine? Cursor says the attacker's server has been taken offline, and on most Macs and Windows PCs the SSH step failed anyway. But the key and the retry scripts stay on your disk until you remove them, and someone could reuse that IP later. Clean up regardless. ### Does uninstalling the extension fix it? No. The extension drops standalone scripts and a scheduled job that keep running after it's gone. Follow Steps 2 to 4. ### Will Cursor tell me if I was affected? Cursor says it will contact the up to 5,000 affected users directly. Don't wait for that email; the check is quicker.