Claude Code Extension Backdoor: Check and Clean Up

On 29 October 2026 a tampered Claude Code extension briefly appeared in the Cursor VS Code Extension Marketplace. The packages used Anthropic's publisher id and the version numbers 2.1.312 and 2.1.313, but they were not built by Anthropic. The injected code tried to plant an SSH backdoor. If you use Cursor on macOS or Windows and may have updated Claude Code that day, this is a short check-and-clean guide: who was in scope, what succeeded without admin rights, the commands to run, and the order that actually removes the persistence.

Who was in the Claude Code extension exposure window

Cursor says the malicious builds were available for about eleven hours:

You are in scope if, during that window, you installed or auto-updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace on macOS or Windows. Microsoft states the same packages were never published on the Visual Studio Marketplace or on npm @anthropic-ai/claude-code, and that Anthropic confirmed their systems were not compromised. Cursor reports no evidence that other extension versions or the official distribution were affected.

So: 2.1.313 on a Cursor install is a strong red flag. 2.1.312 alone is not proof, because that version number also existed upstream. Prove compromise with the install window, the VSIX hashes in Cursor's notice, the svc-telemetry SSH key, or svc-telemetry / the attacker IP inside extension.js.

Linux is awkward. Cursor's "what you should do" section names macOS and Windows, yet the published indicators include Linux paths (user crontab @reboot, /tmp/.stk_*, ~/.config/.smt). Microsoft documents Linux persistence in the loader. There is no Cursor Linux remediation script. If Claude Code ran under Cursor on Linux in that window, run the checks below by hand.

What the malware tried to do

The malicious VSIX kept looking like Claude Code. Injected JavaScript in extension.js ran when the module loaded. Microsoft's reconstruction of the order is:

1. Collect host facts (hostname, username, OS, architecture, home and working directories, Git email) and up to forty environment-variable names that look like secrets (KEY, TOKEN, SECRET, PASS, AWS, GCP). Names only, not values.
2. Append an attacker Ed25519 public key to authorized_keys if the comment svc-telemetry is missing.
3. Try to turn on the local SSH service.
4. Open an outbound reverse SSH tunnel to the attacker's host, forwarding a remote port to local port 22, and retry roughly every sixty seconds.
5. Drop platform-specific persistence outside the extension folder.
6. After a delay, POST the collected host details to a beacon endpoint.

What failed vs what still landed without admin

Turning on Remote Login / OpenSSH Server needs administrator rights. Cursor says that, outside unusual cases where Cursor itself was started elevated, that step failed "due to errors in the malicious code," so the attacker usually could not log in through the tunnel. That is not a clean bill of health. The same notice says the extension still added the SSH key, installed persistence, and sent host details. Treat any positive check as a compromised host until cleaned.

Names like SysMon and com.apple.sysmond are meant to look like monitoring software. Microsoft's guidance: inspect what the startup object actually runs before you delete anything that might be legitimate.

Am I affected? Checks for the Claude Code extension

1. Look for the svc-telemetry SSH key

Cursor's quick check on macOS (also useful on Linux):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, in PowerShell:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If the key is present, Cursor treats the machine as impacted. Microsoft adds: confirm the fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk before you remove the line, and do not treat a missing marker as proof you are clean if telemetry still shows the bad install.

The unauthorized line (from Cursor's IOC list) is:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry

2. Check which Claude Code build you have

cursor --list-extensions --show-versions | grep -i claude-code
ls ~/.cursor/extensions 2>/dev/null | grep -i anthropic.claude-code

The tampered bundles keep the real version number, so Cursor's own remediation scripts match on content, not version alone:

grep -lF svc-telemetry ~/.*/extensions/anthropic.claude-code-*/extension.js 2>/dev/null

Also hunt for dropped files and a listening tunnel:

ls -la ~/.config/.smt ~/.config/.smtk 2>/dev/null
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null   # macOS
crontab -l 2>/dev/null | grep -F '.config/.smt'                    # Linux
pgrep -af 'stk_|/\.config/\.smt|autossh|/ssh .*-R' 2>/dev/null

3. Network and hash indicators (for EDR / hunting)

Cursor and Microsoft both cite attacker host 134.209.82.225, reverse SSH as tunnel@… on TCP 22, and an HTTP beacon on port 8099 (/beacon). Public IP lookups to ifconfig.me or api.ipify.org alone are not indicators. Full VSIX and extension.js SHA-256 values are in Cursor's notice; Microsoft's post also publishes Defender hunting queries if you are in that ecosystem.

Remediation order (do not skip steps)

Use the same response shape I used after the LiteLLM 1.107.0 compromise: check, isolate, clean, rotate, then harden. Updating the extension first and hoping for the best leaves the LaunchAgent, scheduled task, or crontab behind.

macOS

Run as the affected user, not as root, from the folder where you saved the script:

# Official: https://cursor.com/static/security/claude-code-extension/remediate-macos.sh
bash remediate-macos.sh

The script unloads com.apple.sysmond, kills matching tunnel processes, removes extension folders whose extension.js contains svc-telemetry, deletes the dropped files, and strips the attacker key from authorized_keys (including the awkward case where it was appended without a leading newline).

Windows

Close editors first. Open PowerShell as Administrator in the download folder:

# Official: https://cursor.com/static/security/claude-code-extension/remediate-windows.ps1
powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

That script walks every user profile, removes the SysMon task when its action points at smt.cmd, clears Startup sysmon.cmd, kills matching processes, removes infected extension folders, and cleans the key.

Linux (manual)

Cursor did not publish a Linux script. After you have copied evidence aside:

# Stop obvious tunnel loops
pkill -f '/\.stk_[0-9a-f]{10}|/\.config/\.smtk|^/bin/sh .*/\.config/\.smt$' 2>/dev/null || true

# Remove dropped files (keep unrelated ~/.config contents)
rm -f ~/.config/.smt ~/.config/.smtk /tmp/.stk_*

# Edit crontab: drop only the @reboot line that runs ~/.config/.smt
crontab -l 2>/dev/null | grep -vF '.config/.smt' | crontab -

# Strip the exact attacker key; review the file by eye afterward
AUTH=~/.ssh/authorized_keys
if [[ -f $AUTH ]] && grep -qF 'svc-telemetry' "$AUTH"; then
  cp -a "$AUTH" "$AUTH.bak.$(date +%s)"
  grep -vF 'svc-telemetry' "$AUTH" > "$AUTH.clean" && mv "$AUTH.clean" "$AUTH"
fi

# Remove infected extension copies (content match, same idea as Cursor's scripts)
for js in ~/.*/extensions/anthropic.claude-code-*/extension.js; do
  [[ -f $js ]] || continue
  grep -qF svc-telemetry "$js" && rm -rf "$(dirname "$js")"
done

After cleanup: install a clean build and rotate

Install 2.1.314 or later from a channel you trust (npm, Open VSX, or VS Marketplace). As of 7 November 2026 the latest tag on npm and the Open VSX / VS Marketplace listings I checked were 2.1.319. Then, from a different, clean machine, rotate anything that host could reach: SSH keys, GitHub and GitLab tokens, cloud credentials, npm tokens, CI secrets, and AI provider keys. Cursor's wording is that the limited environment-variable collection "does not rule out later credential access over the backdoor." If you cannot rebuild trust in the host, rebuild the machine.

Checklist

• [ ] Confirm whether Cursor auto-updated Claude Code between 29 Oct 14:57 and 30 Oct 02:05 Asia/Colombo (02:27-13:35 PDT on 29 Oct)
• [ ] Run the svc-telemetry grep / PowerShell check on every user profile that uses Cursor
• [ ] Search for .smt / .smtk / .stk_*, com.apple.sysmond.plist, SysMon, and Startup sysmon.cmd
• [ ] Preserve copies of those files and of extension.js before deleting, if you may need forensics later
• [ ] Isolate hosts that show payload or backdoor evidence
• [ ] Run Cursor's macOS or Windows remediation script, or the Linux manual steps
• [ ] Re-run the checks and confirm the script exited 0 / no leftovers
• [ ] Install Claude Code 2.1.314+ (prefer current latest) from an official channel
• [ ] Rotate credentials and revoke sessions from a trusted system
• [ ] Decide whether the host should be rebuilt
• [ ] Tighten extension policy: approved publishers, install cooldown for new versions, pin versions, alert on authorized_keys and LaunchAgent / scheduled-task changes

If you also ship agent tooling for clients, keep the blast radius small the same way you would for skills and mods: least privilege, review what runs in-process, and prefer declarative surfaces like Agent Skills when a full in-editor extension is not required.

Cursor rebuilt the marketplace after removing the bad builds, rotated their own keys, and worked with the hosting provider to take the attacker server down. That stops new installs of those two versions and breaks that C2 endpoint, but it does not clean laptops that already ran the loader. Treat this as a host incident first and an extension update second.