Malicious Claude Code extension on Cursor: check laptops

A malicious Claude Code extension, listed as anthropic.claude-code 2.1.313 on the Cursor Marketplace on 29 October 2026, can add an SSH key and a quiet startup task when the extension's webview first opens. OpenSourceMalware called the NPM package, the OpenVSX build, and the Microsoft VS Code extension clean. SMB IT needs a laptop check, not a company-wide ban on Claude.

What reached developer laptops on 29 October 2026?

A malicious Claude Code extension reached developers through the Cursor Marketplace. OpenSourceMalware describes a package that identifies itself as anthropic.claude-code version 2.1.313, published on 29 October 2026. Dean Hardcastle flagged the live activity to the researchers. Cursor later told OpenSourceMalware the listing had been compromised.

The unpacked extension matches a legitimate build except for extension.js. The bundled binary is the official one. A self-contained 66-line function sits at the top of extension.js, before the expected bundle starts. Diff the head of that file. Do not assume the binary was swapped.

Cursor told OpenSourceMalware that the Claude Code extension in the Cursor Marketplace experienced some form of compromise and was the origin of the malicious build, not Open-VSX. The update links to Cursor’s announcement. That confirmation is not proof of a breach in Anthropic’s release pipeline. The provenance of the analyzed directory is not established, and the sample does not, by itself, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised.

Three other paths were described as not malicious: the NPM package @anthropic-ai/claude-code, the OpenVSX extension, and the Microsoft VS Code Claude extension. A developer who installed Claude Code from those channels is in a different category from someone who pulled 2.1.313 from the Cursor Marketplace around that date.

The source does not say whether Cursor auto-updated developers onto 2.1.313 or whether each person clicked install. Check the editor’s extension install and update logs, and the marketplace history on each laptop. It also does not say whether the listing is still live, how long it was available, or how many downloads it had. Start with laptops that had Cursor in that window.

Why does the malicious Claude Code extension run before any chat?

The malicious Claude Code extension does not wait for a Claude conversation. It activates after VS Code startup, when its webview opens and runs extension.js. The prepended loader runs at that moment. A manager reading chat logs will miss it, because no prompt has to be sent. Do not treat an unused sidebar as proof the loader never ran. The next launch can execute the module.

The package declares no install, build, prepare, preinstall, or postinstall script. The behavior happens at extension runtime. A software inventory that only flags packages with install scripts will not see this build as special.

The malicious stage suppresses nearly every exception so the legitimate extension still loads when a step fails. The developer sees Claude Code come up. The editor does not throw a stack trace that would send someone to the console.

No secondary payload is downloaded. Network behavior in the analysis is public-IP lookups, a JSON beacon, and an interactive SSH tunnel. Shell scripts, batch scripts, and the tunnel key material are generated or decoded from content already inside the extension. No blockchain address, RPC endpoint, contract, wallet, or blockchain-resolved payload location was identified.

Blocking one URL does not remove the implant. Once extension.js has run, the key, the startup files, and the tunnel logic are already on the machine. Call 2.1.313 malicious only when it is this Cursor Marketplace file and extension.js starts with the 66-line loader. The version string alone is not the proof. A same-numbered file from another channel is a different question.

What should you look for on a Mac, Linux PC, or Windows laptop?

Look for an Ed25519 public key whose comment is svc-telemetry in the user’s authorized_keys file, plus startup items that do not belong to Apple, cron, or Windows. The loader creates ~/.ssh with mode 0700, appends that key, and sets authorized_keys to mode 0600. If the marker is already present, the loader records that fact instead of adding a duplicate. The fingerprint is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.

The authorized_keys line in the write-up is:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry

An authorized_keys line grants SSH login as the account that owns the file. It does not grant root or Administrator by itself. A developer account is still enough to read source, Git config, cloud profiles, and signing material.

The loader tries to turn local SSH on, and later stages still run if that fails. On macOS it checks Remote Login and, if that is off, runs sudo -n systemsetup -setremotelogin on. sudo -n cannot prompt, so an ordinary Mac may show no password dialog. On Linux it checks sshd or ssh through systemctl and tries several start commands. On Windows, PowerShell is used to install OpenSSH Server, set automatic start, and start sshd. A failed enablement still leaves the key and the persistence files.

A reverse tunnel uses an embedded private key written to a temporary file whose name starts with .stk_ plus an identifier from the hostname and home directory. The core forwarding request is -N -R '*:0:localhost:22'. That asks the remote server to allocate a port and forward connections to port 22 on the laptop. The session opens outbound, as user tunnel, toward 134.209.82.225. An inbound block on port 22 does not rule the tunnel out. Whether anyone besides the operator can reach the forwarded port depends on the remote SSH settings. The tunnel skips host-key checks, ignores known_hosts, uses only the embedded identity, and reconnects after 60 seconds. On Unix-like systems it prefers autossh and otherwise uses ssh.

Persistence is named to blend in:

• macOS: ~/.config/.smt, ~/.config/.smtk, and the user LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist, with RunAtLoad and KeepAlive, loaded through launchctl load -w. The label mimics an Apple component. It is a per-user agent, not an Apple binary.
• Linux: the same files under ~/.config, plus an @reboot crontab entry for the user.
• Windows: .config\smt.cmd and .config\smtk, a scheduled task named SysMon set to run as SYSTEM, or, if that cannot be confirmed, sysmon.cmd in the Startup folder.
• Temporary key file: ${TMPDIR}/.stk_* on the host that launched the tunnel.

About 1.5 seconds after the loader runs, it looks up the public IP with curl -s --max-time 4 against ifconfig.me and https://api.ipify.org, then posts JSON over plain HTTP. One beacon goes to http://127.0.0.1:8099/beacon. The other goes to http://134.209.82.225:8099/beacon. The reply is discarded. There is no response-to-code path in this stage.

The first beacon sends hostname, local username, operating system, CPU architecture, home directory, current working directory, and the global Git email from git config –global user.email. It also sends the names, not the values, of up to 40 environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS, or GCP. The secret strings themselves are not included. Those names still show whether AWS, GCP, a CI system, or a token type is configured. Once an operator can log in as the developer, they can read shell history, cloud CLI files, SSH agent state, and repository remotes. If a proxy log shows only the beacon and svc-telemetry is still in authorized_keys, the incident is not finished. The beacon’s variable names are a map of which systems to rotate first. CI/CD pipeline security is the matching review for runners and tokens that workstation can reach.

Hashes from the analyzed artifact:

• extension.js SHA-256: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
• Embedded tunnel private key SHA-256: 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278
• Also search for 134.209.82.225 on ports 22 and 8099, the account tunnel@134.209.82.225, and the comment svc-telemetry.

There is no second-stage download in this injected code. An operator who logged in before cleanup could still have changed other keys, shell profiles, or Git remotes. Collect process trees, network connections, crontabs, LaunchAgents, and scheduled tasks before you delete files. Search process telemetry for long-running ssh or autossh commands containing -R *:0:localhost:22. If the session is unexplained, threat hunting and compromise assessment uses the evidence you saved before cleanup.

What is safe to keep using, and what should you remove?

Keep Claude Code that came from the channels researchers called clean, and quarantine Cursor Marketplace build 2.1.313. The clean set is the NPM package @anthropic-ai/claude-code, the OpenVSX extension, and the Microsoft VS Code Claude extension. Cursor’s statement places the origin on the Cursor Marketplace listing, not on Open-VSX. A blanket removal of every Claude install burns time on copies the researchers called clean.

On a machine that had 2.1.313 from Cursor, or that shows the artifacts:

1. Disconnect the host from production networks, source remotes, and cloud APIs before broad deletion, so live sessions are still visible.
2. Block 134.209.82.225 on ports 22 and 8099 at the host and at the edge. That covers SSH to the tunnel account and the plain HTTP beacon.
3. Record process trees, listening sockets, established ssh and autossh sessions, crontabs, LaunchAgents, and scheduled tasks.
4. Terminate unexpected ssh and autossh processes tied to the tunnel, including commands with -R *:0:localhost:22.
5. Remove the Cursor Marketplace extension build. Uninstalling the extension is not eradication.
6. Delete the svc-telemetry line from authorized_keys and review any other keys you do not recognize.
7. Remove the .smt and .smtk files, the com.apple.sysmond.plist user agent, the @reboot cron line, the Windows .config scripts, the SysMon task, and any Startup-folder copy of sysmon.cmd.
8. Confirm Remote Login, sshd, or Windows OpenSSH was not left on when your standard build keeps it off.
9. Rotate Git credentials, cloud keys, CI tokens, signing keys, and SSH material the affected account could read, from a known-clean machine. A password change on the suspect laptop leaves the key and any tunnel in place.

Rebuild the laptop when you cannot confidently exclude interactive access. Deleting the listed files does not establish how long the key was present or what an operator changed. A clean extension.js hash after reinstall proves the current file only. A secrets and credential exposure assessment is the structured version of that rotation.

How should a team lead set an IDE plugin allow-list?

Allow IDE plugins from named publishers and marketplaces, and block sideloaded VSIX files and unreviewed marketplace installs on machines that hold production credentials. Cursor’s confirmation covers one extension and one marketplace. It does not replace a rule for the next plugin.

• Inventory extensions on every developer laptop: publisher, version, install date, marketplace, and whether the log shows an update or a manual install. The source dates anthropic.claude-code 2.1.313 on Cursor to 29 October 2026. Machines that installed or updated Claude Code from Cursor in that window go first.
• Separate editor allowed from extension allowed. Cursor as an editor and this marketplace build are different decisions.
• Pin internal builds of trusted extensions and review publisher identity when a display name looks like a vendor. This build self-identified as anthropic.claude-code. The name on the card is not proof of who published the bits.
• Disable automatic extension updates on hosts that can reach production, or gate updates through a reviewed internal feed. The source does not say this build was pushed automatically. The control still closes the next silent update.
• Alert on new authorized_keys lines, new user LaunchAgents, new @reboot cron entries, and new scheduled tasks named like system monitors. SysMon and com.apple.sysmond are this case. Alert on new persistence, not only those two strings.
• Keep SSH off on developer laptops unless remote login is an approved admin path. This loader tries to turn it on. A host that already ran sshd still needs the authorized_keys check.
• Write down where AI coding tools may be installed: marketplace, package name, and who approves a new one. Record the clean channels from this report, with the date, and revisit them when the vendors publish more.

What is still unknown belongs next to the checklist. The analyzed directory’s provenance is not established. No public count of affected developers, listing duration, or download total is in the source. The write-up does not name an attacker. Scope the response to machines that had the Cursor Marketplace build or that show the host artifacts, and widen only when evidence says so. Software supply chain security testing is how you test the extensions and dependencies you did not write and still run.

Ask each developer three questions and write the answers down: which editor, which marketplace or package manager, and whether the laptop is used for production Git, cloud, or signing. Then run the file and process checks.

FAQ

Was the Claude Code extension on the Cursor Marketplace hacked?

Cursor told OpenSourceMalware that the Claude Code extension in the Cursor Marketplace experienced some form of compromise and was the origin of the malicious build, not Open-VSX. The build identifies itself as anthropic.claude-code 2.1.313, published 29 October 2026.

Is the official Claude Code VS Code extension safe?

The researchers described three paths as not malicious: the NPM package @anthropic-ai/claude-code, the OpenVSX extension, and the Microsoft VS Code Claude extension. That finding is about those channels, not about every file named Claude Code.

How do I know if Claude Code 2.1.313 is malicious?

Treat 2.1.313 as malicious when it is the Cursor Marketplace artifact whose extension.js starts with the 66-line loader. Match extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. The version string in some other filename is not, by itself, the same artifact.

Did Anthropic's Claude Code supply chain get compromised?

The public analysis does not demonstrate that. Cursor confirmed a compromise of the Cursor Marketplace listing as the origin of this build. The researchers say the sample does not, by itself, prove Anthropic's official release infrastructure was compromised.

If a developer laptop shows svc-telemetry, com.apple.sysmond, or a tunnel toward 134.209.82.225, preserve the logs before you wipe the disk. SafetyBis can run threat hunting and compromise assessment on the workstations that had the Cursor Marketplace build, then test the extension path with software supply chain security testing.