Trojanized Claude extension plants SSH backdoor
claude cursor
| Source: HN | Original article
A trojanized Claude Code Extension (v 2.1.313) contains a pre‑loader that installs an SSH backdoor before the legitimate extension code runs.
A malicious build of the Claude Code extension for Visual Studio Code and the Cursor editor has been discovered to install an SSH backdoor on developers’ machines. The compromised package, version 2.1.313, appears in both the official VS Code marketplace and Cursor’s extension store. Analysis published by OpenSourceMalware shows the extension’s loader runs before the legitimate code, injects an attacker‑controlled SSH key, opens a reverse tunnel to an external server and writes persistence hooks. It also exfiltrates basic host information before being superseded by a clean release, version 2.1.314.
The incident matters because Claude Code is a widely used AI‑assisted coding tool, and its extensions are often added without rigorous vetting. By hijacking the supply chain, threat actors can gain persistent, low‑profile access to development environments, potentially harvesting proprietary source code or using the compromised machines as footholds for broader network intrusion. The attack follows a string of recent Claude Code security concerns – earlier this week we reported on the extension leaking users’ email addresses and, separately, on a version that surfaced thousands of personal photos on an Android device. The pattern underscores the risk of trusting third‑party AI tooling without robust integrity checks.
Developers should immediately uninstall version 2.1.313, rotate any SSH keys added to their accounts, and audit systems for unknown persistence mechanisms. Anthropic has issued a replacement build (2.1.314) and is urging users to update. Watch for further guidance from the vendor, possible investigations into how the tampered artifact entered the official marketplaces, and any broader supply‑chain alerts affecting other AI‑powered extensions.
Sources
Back to AIPULSEN