Cursor Pulls Backdoored Claude Code Extension Builds Planting SSH Keys

On October 30, 2026, endpoint detection and response firm Phorion announced that it had discovered a persistent Secure Shell (SSH) backdoor embedded within official builds of the Claude Code for VS Code extension distributed on the Cursor Marketplace Source 1 · Hacker News. Following Phorion's initial disclosure at 05:30 UTC and subsequent advisory revisions, Cursor pulled the affected releases—identified as versions 2.1.312 and 2.1.313—from its marketplace distribution systems. The malicious packages contained logic designed to compromise developer workstations across macOS, Linux, and Windows environments, planting authorized cryptographic keys and establishing persistence mechanisms before an end user initiated any explicit interaction with the extension.

Injected Architecture and Immediate Node Loader Execution

The architectural compromise observed by Phorion did not rely on standard user interaction or explicit permission confirmations within the editor interface Source 1 · Hacker News. Because extensions distributed via the Cursor Marketplace execute with the permissions of the Cursor IDE and the operating system user running the process, any code executed during module ingestion obtains immediate access to local file systems, source code directories, shell environments, and developer credentials.

Inspection of the backdoored distribution bundles revealed that the underlying extension.js file was modified by prepending an injected immediately invoked function expression (IIFE) directly to the minified code Source 1 · Hacker News. The remainder of the bundle retained the authentic Claude Code and VS Code source strings, legitimate user interface routines, and standard activate and deactivate lifecycle exports. By inserting an IIFE at the top of the file, the adversary ensured that the malicious routines fired as soon as the Node.js runtime imported the script, long before the editor called the extension's legitimate activate callback.

The injected prefix imported several core Node.js modules—including child_process, fs, os, path, http, and crypto—to inspect the host environment and modify system configurations without introducing anomalous third-party external package dependencies Source 1 · Hacker News.

Key Injection Mechanics and the macOS Execution Flaw

Once loaded into memory, the malicious routine executes an initial credential drop targeting developer Secure Shell configurations Source 1 · Hacker News. The script verifies whether the local user directory contains a ~/.ssh directory, creating it if absent, and then appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys. The payload explicitly enforces standard UNIX permission boundaries by applying 0700 permissions to the .ssh directory and 0600 permissions to the authorized_keys file to ensure the SSH daemon will accept the planted credentials. Phorion observed that the public key entry included the trailing comment string svc-telemetry, and the script performed a preliminary check against existing records to avoid duplicate appends if an entry containing svc was already present.

Despite the sophisticated distribution vector, Phorion's reverse engineering revealed an implementation bug in the macOS setup routines that materially limited the backdoor's remote reach on default systems Source 1 · Hacker News. To enable inbound interactive logins on macOS, an operator must activate Remote Login via the administrative utility systemsetup. The injected script executes systemsetup -getremotelogin under the assumption that it can evaluate the host's current service status as a standard unprivileged user.

However, executing systemsetup -getremotelogin without root privileges prompts macOS to output an administrative access error while returning an exit code of 0, rather than printing the string Off Source 1 · Hacker News. Because the implant's logic only triggers the subsequent systemsetup -setremotelogin on command when the returned output strictly equals Off, the script skips service enablement entirely. On Apple hosts where SSH was not already running prior to extension installation, this implementation mistake prevented the adversary from opening an inbound remote shell port, even though the attacker's Ed25519 public key was successfully appended to authorized_keys and host persistence scripts were established.

Host Reconnaissance and Cross-Platform Implant Logic

While Phorion's technical post focused heavily on macOS, the security firm confirmed that the payload contained dedicated setup, persistence, and reconnaissance routines tailored for Linux and Windows platforms as well Source 1 · Hacker News. Phorion noted that implementation bugs also affected execution across these non-Apple platforms, though the implant consistently attempted to establish persistence and gather system context.

Beyond attempting to configure inbound SSH entry points, the malicious prefix performed local host discovery and initiated outbound communications back to the operator's infrastructure using Node's native http module Source 1 · Hacker News. Phorion confirmed that the implant transmitted host reconnaissance beacons while attempting to establish long-term, interactive shell access across targeted endpoints. Because developer workstations frequently maintain elevated network access to corporate internal code repositories, production environments, and cloud infrastructure, a compromised development machine represents a prime staging ground for broader enterprise lateral movement.

Phorion Incident Response Recommendations

In light of the confirmed distribution of malicious extension packages, Phorion advised software organizations to review their developer environments immediately for any presence of Claude Code for VSCode version 2.1.312 or 2.1.313 Source 1 · Hacker News. Phorion recommended that teams encountering these specific builds initiate formal incident response procedures to determine whether endpoints were compromised.

Phorion's analysis suggests that security personnel inspecting workstations should examine local user profiles for unauthorized cryptographic additions Source 1 · Hacker News. Specifically, security teams should inspect the ~/.ssh/authorized_keys file for any entries bearing the svc-telemetry comment or unfamiliar Ed25519 public keys planted around the time of extension installation. Furthermore, because the implant issues outbound reconnaissance beacons via HTTP and drops local persistence artifacts, telemetry and proxy logs should be evaluated for unauthorized Node.js network requests initiated from developer IDE paths.

Unresolved Supply Chain Scope and Marketplace Gaps

While the technical mechanics of the extension's JavaScript wrapper have been documented, several foundational questions regarding the incident remain unaddressed by both Cursor and Anthropic. The incident documentation tracks several immediate scope corrections: Phorion initially published its findings on October 30 at 05:30 UTC, subsequently updated the affected registry identity to Cursor at 09:13 UTC, and later expanded the compromised version inventory to encompass release 2.1.312 at 00:43 UTC on October 31 following an updated notice from Cursor Source 1 · Hacker News.

Crucially, the exact mechanism of the upstream compromise remains unknown. The available evidence does not clarify whether the adversary compromised the extension publisher's authentication credentials, exploited a flaw in Cursor's packaging and ingestion pipelines, or introduced malicious commits into an automated release workflow Source 1 · Hacker News. Furthermore, neither Cursor nor Phorion has published telemetry detailing total download numbers, the specific calendar window during which versions 2.1.312 and 2.1.313 were served to developers, or whether the compromised builds were mirrored to any secondary package registries. Until marketplace operators provide forensic transparency into account provenance and distribution logs, development organizations must treat editor extension ecosystems as unverified attack surfaces that demand rigorous endpoint auditing.