Trojanized Claude Code VS Code extension installed a persistent SSH backdoor

A malicious version of the Claude Code extension for Visual Studio Code was briefly distributed and installed a persistent SSH backdoor on developer machines, according to The Hacker News. The report, dated October 30, 2026, says the trojanized package was not built by Anthropic and was pulled after security researchers flagged it.

What happened

The Hacker News says the package identified itself as anthropic.claude-code version 2.1.313 and that its main JavaScript bundle contained a 66-line malicious loader inserted before the legitimate extension code. Security firm OpenSourceMalware disclosed the issue; co-founder Jenn Gile and researcher Paul McCarty are quoted in the report. The article is inconsistent on the distribution channel, first attributing it to a compromise on the Open VSX registry and later to the Cursor IDE extension marketplace; Cursor said the modified extension was "accessed through our Cursor IDE extension marketplace." Cursor stated the incident affected at most 5,000 users who installed the version between roughly 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.

Technical details

According to the report, the loader activated after VS Code startup and when the extension's webview opened. It added an attacker-controlled SSH key to ~/.ssh/authorized_keys, labeling it "svc-telemetry" to look benign, and attempted to enable SSH on Windows, Linux and macOS while opening a reverse tunnel to 134.209.82.225. It installed platform-specific persistence through a scheduled task, a crontab entry and a LaunchAgent, and sent reconnaissance data over unencrypted HTTP to 134.209.82.225:8099/beacon. The collected data included the public IP, hostname and username, operating system and CPU architecture, home and working directories, the global Git email, and the names — not the values — of up to 40 environment variables containing strings such as KEY, TOKEN, SECRET, PASS, AWS or GCP. McCarty noted that the variable names alone can reveal which cloud providers and credential types are configured, and that SSH access would let an operator inspect the account directly. Cursor said that on most macOS and Windows hosts enabling SSH requires admin rights the extension lacks, so the tunnel step fails there, but the key addition, persistence and data exfiltration still occur.

Who is affected

Developers who installed version 2.1.313 during the October 29 window are at risk, and The Hacker News notes that those with auto-update enabled could have pulled the malware even though it was removed quickly. The report says no additional follow-on payloads have been observed.

What to do

The Hacker News recommends isolating affected hosts, removing the unauthorized SSH key and all persistence mechanisms (the scheduled task, crontab entry and LaunchAgent), rotating credentials and sessions, and updating to the clean extension version 2.1.314 that Anthropic published to Open VSX and the VS Code Marketplace. Cursor said it briefly took its service down to remove the malware and would contact affected users directly. The report also notes a related incident about a week earlier in which an attacker replaced release binaries of five OVHcloud CLI versions with secret-stealing malware tied to the GlassWorm operation.