TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Phorion reported that Claude Code for VS Code versions 2.1.312 and 2.1.313 on the Cursor Marketplace contained code that added an SSH public key and attempted to establish persistent remote access. Cursor removed the affected versions, according to Phorion; the report says the SSH setup can fail on some macOS systems, but the payload also installs persistence and sends host reconnaissance.
Security researchers at Phorion reported that two versions of the Claude Code for VS Code extension on the Cursor Marketplace contained a backdoor that tried to create persistent SSH access to users’ computers. Phorion identified versions 2.1.312 and 2.1.313 as affected, and said Cursor removed them from its marketplace; the incident could expose developer machines, source code and local files.
Phorion’s report says the malicious code was inserted at the start of the extension’s extension.js file. It runs when the extension module loads, before the normal activation function, so users do not have to open a particular feature or interact with a prompt for the code to execute. The rest of the bundle appeared to contain the extension’s ordinary code, according to the researchers.
The payload creates or uses the user’s .ssh directory and appends an attacker-controlled Ed25519 public key to authorized_keys. It then attempts to enable the system’s SSH service, with different procedures for macOS, Linux and Windows. Phorion said the code also sets up persistence and sends host reconnaissance to an operator. The report does not publish the embedded public key in its example, so defenders are advised to check key fingerprints rather than rely only on the comment attached to a key.
Phorion said the macOS procedure may fail to turn on Remote Login in a common standard-user setup. The script checks the setting without administrator privileges and looks for the word “Off”; macOS may instead return an administrator-access error, which the researchers say exits with status zero. Because the script’s check may not match “Off,” it can skip the step to enable SSH. That limitation does not rule out the other reported behavior, including writing the SSH key or installing persistence. Phorion also described a likely defect in the Windows service setup, which passes a PowerShell command through a helper that invokes /bin/sh.
Risk to Developer Workstations
Code editor extensions can run with access to the files and tools available to the editor and the account using it. A malicious extension therefore puts more than the editor itself at risk: a compromised developer workstation may contain source code, credentials, configuration files and access to internal development systems. If an attacker can authenticate through an added SSH key, the machine could also offer a route for continued access, provided the SSH service is running and reachable.
The report’s account of a macOS setup bug narrows one part of the possible impact, but it is not evidence that every installation is harmless. Phorion says the script still writes SSH-related files and attempts persistence and host reconnaissance. The report gives no confirmed count of affected installations or evidence of specific victims, so organizations should treat the extension’s presence as a reason to investigate rather than assume that remote access was successfully established on every device.
For organizations, the incident illustrates why software distributed through an extension marketplace should be treated as executable code, not merely as an interface add-on. Teams that use the affected versions may need to review developer machines and consider whether source code or credentials on those systems require further protection or incident response.
Products Worth Considering
eufy Security Video Doorbell E340 Kit with Chime, 2K Resolution and 8GB Local Storage
eufy Security SoloCam E42 4-Camera Kit, 4K Solar Security Cameras with HomeBase 3
eufy Security E30 4K Indoor Camera, 2-Pack
As an affiliate, we earn on qualifying purchases.
How the Extension Was Compromised
The affected software is the Claude Code for VS Code extension distributed on the Cursor Marketplace. The report concerns that marketplace listing and does not establish that every distribution channel or every version of the extension was affected. Phorion’s analysis describes a payload prepended to the bundled JavaScript, allowing it to run as Node.js loads the extension.
In its revision history, Phorion said the report was first published on October 30 at 05:30 UTC, corrected the marketplace identification at 09:13 UTC, and updated the affected-version scope on October 31 at 00:43 UTC to include version 2.1.312. The report identifies versions 2.1.312 and 2.1.313 and says Cursor removed both. Those dates and version details are from Phorion’s published account.
The payload’s system-service steps do not, by themselves, demonstrate privilege escalation. Phorion says the macOS command uses non-interactive sudo, which will not succeed unless the user already has suitable passwordless access or a cached authorization. The report also notes implementation problems in the macOS and Windows paths, underscoring that the code’s intended behavior and its success on a particular machine are separate questions.
“The goal of this payload is long-term interactive access.”
— Phorion
What the Investigation Has Not Established
Phorion’s report does not state how many users or organizations downloaded either affected version, whether any attacker successfully used the embedded key, or whether specific machines were accessed. It also does not identify the person or group behind the payload or establish how the extension bundle was compromised. These points remain distinct from the technical behavior Phorion says it found in the package.
The report’s platform observations describe attempted behavior and apparent code defects, not a device-by-device measure of impact. Whether SSH was already enabled, whether the payload’s persistence steps worked, and whether reconnaissance data reached an operator may vary by system. Organizations will need to examine their own extension records and machines to establish exposure.
Review Affected Builds and Hosts
Organizations should check developer machines and software inventories for Claude Code for VS Code versions 2.1.312 and 2.1.313, the versions Phorion identified. Where either version was present, teams should follow their incident-response procedures and examine SSH authorized-key files, persistence locations and relevant network or system logs. Phorion recommends engaging incident response when use of the extension is discovered.
Cursor has removed the affected versions, according to the report, but the supplied material does not describe a replacement release, a complete remediation procedure or a marketplace-wide audit. Users and security teams should consult current notices from Cursor and the extension publisher for guidance on safe versions and cleanup. A finding that the SSH service was not enabled should not be treated on its own as proof that the machine was unaffected.
Key Questions
Which Claude Code extension versions were reported as affected?
Phorion identified versions 2.1.312 and 2.1.313 of Claude Code for VS Code on the Cursor Marketplace. It said Cursor removed both versions.
What did the backdoor attempt to do?
According to Phorion, the payload added an attacker-controlled public key to the user’s SSH authorized_keys file, tried to enable SSH, installed persistence and sent host reconnaissance to an operator.
Does the reported macOS bug mean affected Macs are safe?
No. Phorion said the macOS check can fail to enable Remote Login when run without administrator privileges. The report also says the payload may still write the SSH key and install persistence. The impact on any particular Mac requires investigation.
What should an organization do if it finds an affected version?
Identify the machine and version, preserve relevant evidence, and follow the organization’s incident-response process. Phorion advises engaging incident response where use of the extension is discovered; teams should also review SSH keys, persistence and relevant logs.
Source: phorion.io
