Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Your installed VS Code extensions can now install SSH backdoors and exfiltrate data without your interaction.

A security vulnerability has been discovered in the official Claude Code for VS Code extension, distributed via the Cursor Marketplace. Researchers at Phorion found that version 2.1.313 of the extension bundle contains a malicious payload designed to establish a persistent SSH backdoor on macOS, Linux, and Windows systems. The backdoor attempts to install an attacker-controlled public SSH key into the user's authorized_keys file and enable remote login. While a specific bug in the macOS implementation may prevent SSH enablement under certain conditions for standard users, the persistence and reconnaissance beaconing capabilities remain a significant threat. Cursor has since removed the compromised release from its marketplace and related registries. Organizations are advised to immediately audit their environments for the use of this extension version and initiate incident response if found.

The compromise highlights the inherent risks of running extensions with broad permissions within development environments. Because IDE extensions execute with the user's privileges, a malicious extension can gain immediate access to sensitive source code, local files, and developer tools. This incident underscores the critical need for rigorous security vetting of marketplace extensions, as even officially distributed tools can become vectors for sophisticated attacks. Developers and organizations must exercise extreme caution and implement strong oversight for all third-party code integrated into their workflows.

The discovery of this backdoor, particularly its multi-platform persistence mechanisms and SSH tunneling, indicates a significant advancement in stealthy remote access techniques targeting developers. The method of establishing a reverse SSH tunnel allows attackers to bypass typical network defenses and gain interactive shell access by leveraging the victim's own system. This approach signifies a move towards more direct and persistent compromise strategies, making detection and remediation particularly challenging for security teams.