Security firm Phorion has confirmed a supply chain compromise affecting the official Claude Code for VS Code extension, specifically version 2.1.313 distributed via the Cursor Marketplace. The malicious bundle introduces a persistent SSH backdoor capable of granting attackers long-term interactive access across macOS, Linux, and Windows environments. Cursor has since removed the compromised release from its marketplace and pulled the corresponding NPM and VSCode versions from their registries.

Anatomy of the Infection Chain

The compromise begins with an injected immediately invoked function expression (IIFE) prepended to the standard extension bundle. This payload executes immediately upon Node.js module loading, before the extension’s normal activate callback runs, requiring no user interaction. The malware first ensures the ~/.ssh directory exists and appends an attacker-controlled Ed25519 public key, tagged with the comment 'svc-telemetry', to the user's authorized_keys file. It then attempts to enable the local SSH daemon, though implementation bugs vary by platform.

The macOS Implementation Flaw

On macOS, the malware attempts to enable Remote Login using 'sudo -n systemsetup -setremotelogin on'. However, the script first checks the current status using 'systemsetup -getremotelogin' without elevation. Because this command requires administrator privileges, it returns an error message rather than a status, causing the malware to incorrectly assume SSH is already enabled. Consequently, the script skips the enablement step entirely on systems where SSH is off, breaking the inbound access path despite successfully planting keys and persistence artifacts.

Persistence and Exfiltration Mechanics

The backdoor establishes a reverse SSH tunnel to 134.209.82[.]225, using a dynamically allocated remote port to forward traffic to localhost:22. For persistence, the malware drops a LaunchAgent on macOS disguised as 'com.apple.sysmond.plist', a shell script on Linux with a crontab entry, and a scheduled task or startup script on Windows. Additionally, it beacons host reconnaissance data, including hostname, OS details, and names of environment variables matching patterns like 'KEY', 'TOKEN', or 'SECRET', via plaintext HTTP POST requests to port 8099.

Key Takeaways

  • The compromised extension version is strictly 2.1.313; users should verify their installed version immediately.
  • On macOS, the backdoor may fail to enable SSH if it isn't already running, but keys and persistence are still installed.
  • Detection requires monitoring file modifications to ~/.ssh/authorized_keys by IDE helper processes, not just shell commands.
  • Remediation must include killing tunnel processes, removing LaunchAgents/cron jobs, deleting planted keys, and rotating credentials if SSH access was confirmed.

The Bottom Line

This incident underscores the fragility of supply chain security in developer tooling, where a single compromised extension can silently pivot from a productivity tool to a persistent remote access vector. Developers must treat extension bundles as executable code with full system privileges, not just passive configuration files.