A compromised version of Anthropic’s official Claude Code extension for VS Code planted a persistent SSH backdoor on developers’ machines, according to security firm Phorion.
Security researchersuncovered a malicious Claude Code for VS Code extension that contains a persistent Secure Shell (SSH) backdoor. Open VSX is an open-source extensions marketplace to VS Code-compatible AI-powered code editors like Cursor and Windsurf.
Cursor, whose extension marketplace draws from Open VSX, said up to 5,000 of its users were affected and that the malicious version “was not developed by Anthropic.”
Since the extension runs within the integrated development environment, the backdoor provides the attackers with immediate access to local files, source code, and developer tooling as soon as its module is loaded. The extension includes persistence logic for macOS, Linux, and Windows devices.
Phorion said Anthropic removed version 2.1.313 from Open VSX and also pulled it from npm and the VS Code Marketplace. The security firm further urged companies to review their environments for Claude Code for VSCode 2.1.313.
The attack begins when a developer downloads and runs the malicious extension, which injects a prefix that pulls in standard Node.js modules and executes as soon as Node loads the file. The malicious file then appends an attacker-controlled Ed25519 public key to the user’s SSH authorized_keys file, which grants login access to the machine.
“With the key in place, anyone holding the matching private key can authenticate as that user, provided SSH is actually running. The next step in the script tries to make sure the local SSH daemon is enabled and listening,” the researchers said.
The malicious script then sets up an outbound SSH connection and writes a tunnel key for remote port forwarding, dynamically allocating a listening port to forward any traffic.
“When the operator wants to access the machine, they start a separate SSH session through the allocated port on their server, authenticating against the victim’s local SSH daemon using the key planted in Stage 1,” the security firm said. This step allows the attackers to gain full interactive shell and file transfer capability without needing any custom C2 command.
In the final stage of the attack, the malicious script collects the hostname, username, OS platform, architecture and home directory, along with other host reconnaissance information.
In addition to removing the malicious extension, Phorion recommends that developers kill active tunnel processes, unload and delete ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS to remove persistence, clean up the planted SSH key and rotate credentials.
