# Claude Code extension detection pack: trojanised Anthropic.claude-code 2.1.313 (Cursor marketplace, 29 Oct 2026)

Read-only checkers and hunting content for a supply-chain compromise (no CVE). A maliciously modified build of Anthropic's Claude Code VS Code extension, `Anthropic.claude-code` version **2.1.313**, not built by Anthropic, was served by Cursor's VS Code extension marketplace on 29 October 2026. It plants an attacker SSH key, installs persistence, tries to open a reverse SSH tunnel and beacons host details. Last refreshed 30 October 2026, 11:30 GMT, against Cursor's security notice, the Open VSX and VS Code Marketplace listings, Anthropic's changelog and GitHub advisories, and news reporting.

The KQL in this pack **has not been run against a live tenant**. Sigma rules pass `sigma check` and convert to KQL; checkers and tests run offline.

## Status at a glance (checked 30 Oct 2026)

| Item | Status | Source |
|---|---|---|
| What | Malicious `Anthropic.claude-code` 2.1.313, "not developed by Anthropic", served by the Cursor VS Code extension marketplace | [Cursor security notice](https://cursor.com/blog/claude-code-extension-security-notice) |
| Window | 29 Oct 2026, "about 2:27am PT and 1:35pm PT" = **09:27 to 20:35 GMT/UTC** (US was on PDT, UTC-7; UK on GMT since 25 Oct) | Cursor |
| Scale | "At most 5,000 users"; Cursor "will reach out directly" | Cursor |
| Other extensions | Cursor "audited access and confirmed no other extensions were tampered with" | Cursor |
| Attacker server | Taken offline with the hosting provider; tunnel and beacon "not functional" | Cursor |
| Fixed version | **2.1.314** on Open VSX (published 30 Oct 2026 01:07 GMT) and the VS Code Marketplace (30 Oct 2026, about 01:17 GMT) | [Open VSX API](https://open-vsx.org/api/Anthropic/claude-code), VS Code Marketplace gallery API, [The Hacker News](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) |
| Open VSX | 2.1.313 is **not** in Open VSX's version list (2.1.312 then 2.1.314) | Open VSX API |
| Anthropic | No security statement found. The 2.1.314 changelog lists only normal product changes. No GitHub security advisory in `anthropics/claude-code` and none in the GitHub Advisory Database for this | [CHANGELOG](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md), [repo advisories](https://github.com/anthropics/claude-code/security/advisories) |
| Remediation | Cursor scripts: `remediate-macos.sh` (run as the user, not root) and `remediate-windows.ps1` (elevated). **No Linux script is published** | Cursor |

## Confirmed vs unverified

**Confirmed by Cursor (primary source):**

- Collects hostname, username, OS, architecture, home directory, environment variable **names**, working directories, configured Git email and public IP.
- Appends an attacker key labelled `svc-telemetry` to `authorized_keys`; tries to enable the local SSH service and open a reverse SSH tunnel. Outside "highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail". The key, persistence and beacon still happen.
- Persistence: LaunchAgent (macOS); scheduled task trying to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel about every 60 seconds.
- Beacon: HTTP POST to `/beacon` on port 8099. Uninstalling the extension "may not be sufficient".

**Indicators published verbatim by Cursor** (defanged in the notice):

| Type | Value |
|---|---|
| Attacker IP | `134.209.82.225` (Cursor; also The Hacker News) |
| Reverse SSH | `tunnel@134.209.82.225`, TCP 22 |
| Beacon | `http://134.209.82.225:8099/beacon` (POST); loopback attempt `127.0.0.1:8099/beacon` |
| Public IP lookups | `ifconfig.me`, `api.ipify.org` (legitimate; not an indicator alone) |
| Key | `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry` |
| Key fingerprints | planted key `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk`; reverse-tunnel key `SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ` |
| VSIX SHA-256 | darwin-arm64 `432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62` (MD5 `da5469c4221775e9fe2e413e59ca7fd9`); win32-x64 `3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081` (MD5 `bd3b71ddf3d0cc3af76249afd2c0eda1`) |
| Modified code | `extension.js` in `anthropic.claude-code-2.1.313-darwin-arm64` / `-win32-x64` contains `134.209.82.225` and `svc-telemetry` |
| macOS files | `~/.ssh/authorized_keys`; `~/.config/.smt`, `~/.config/.smtk`; `$TMPDIR/.stk_<10 hex>`; `~/Library/LaunchAgents/com.apple.sysmond.plist` (label `com.apple.sysmond`) |
| Windows files | `%USERPROFILE%\.ssh\authorized_keys`; `%USERPROFILE%\.config\smt.cmd`, `smtk`; `%TEMP%\.stk_<10 hex>`; task `SysMon`; fallback `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd`. Cursor's Windows check also reads `C:\ProgramData\ssh\administrators_authorized_keys` |
| Commands | `ssh -N -R '*:0:localhost:22'`, `autossh -M 0`; options `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null`, `ServerAliveInterval=30`, `ServerAliveCountMax=3`, `ExitOnForwardFailure=yes`, `IdentitiesOnly=yes`; `schtasks /create /tn SysMon`; `systemsetup -setremotelogin on`; `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0` |

**News or public research only (NOT confirmed by Cursor or Anthropic):**

- Linux **crontab** persistence (The Hacker News). Cursor lists only the LaunchAgent and the Windows task, publishes no crontab line and no Linux script. This pack matches cron entries only on the published IP, file names and tunnel options.
- "Up to 40" environment variable names matching KEY, TOKEN, SECRET, PASS, AWS or GCP, and that values were not sent (security researchers quoted by The Hacker News). Cursor says only "environment variable names".
- Auto-update could have pulled 2.1.313 without the user acting (security researchers quoted by The Hacker News). Plausible, not stated by Cursor.
- A 66-line loader inserted before the legitimate code; activation at startup and when the webview opens (The Hacker News, quoting researchers).
- "No other follow-on payloads observed" (The Hacker News).
- Some public research says 2.1.313 was published to Open VSX. The Open VSX version list does not contain 2.1.313, and The Hacker News corrected its story to say the incident traces to Cursor's marketplace, not Open VSX.

## Who is affected

Anyone who installed or auto-updated `Anthropic.claude-code` to 2.1.313 **from Cursor** between 09:27 and 20:35 GMT on 29 Oct 2026. Cursor names macOS (darwin-arm64) and Windows (win32-x64) builds; Linux is mentioned only in news. VS Code users who pull from the Microsoft VS Code Marketplace are not reported as affected, but check anyway: profiles get synced and copied, and Windsurf / VSCodium-style editors sometimes share extension folders.

## Timeline (GMT)

| When | What | Source |
|---|---|---|
| 29 Oct 2026 about 09:27 | 2.1.313 available on Cursor's marketplace | Cursor |
| 29 Oct 2026 about 20:35 | Removed; marketplace shut down, rebuilt, keys rotated | Cursor |
| 29 Oct 2026 | Cursor security notice published | Cursor |
| 30 Oct 2026 01:07 / about 01:17 | 2.1.314 on Open VSX / VS Code Marketplace | registry APIs |
| 30 Oct 2026 | News coverage | The Hacker News |

## Proactive steps

1. **Inventory editors and extensions** on every managed device: Cursor, VS Code, VS Code Insiders, Windsurf, VSCodium, remote/server installs (`~/.vscode-server`, `~/.cursor-server`). Run the checkers below with `--all-users` / `-AllUsers`, and KQL Q8.
2. **Update** `Anthropic.claude-code` to **2.1.314 or later** everywhere.
3. **Block `134.209.82.225`** at firewalls, proxies and Defender for Endpoint (custom network indicator), inbound and outbound, and alert on hits. The host is offline now but the address may be reused.
4. **Allow-list extensions** on managed devices (VS Code `extensions.allowed` policy or equivalent controls for Cursor) and pin versions for AI coding extensions.
5. **Disable extension auto-update** for AI extensions on managed devices (`extensions.autoUpdate: false` via policy) and stage updates after a short delay.
6. **Review outbound TCP 22** from user endpoints. Most laptops only need it to known Git hosts; deny the rest.
7. Make sure Remote Login (macOS) and OpenSSH Server (Windows) are off on endpoints that do not need them, and that users are not local admins by default.

## Reactive steps

Look for (checkers plus KQL):

1. **The key**: `svc-telemetry` or the published key blob in any `authorized_keys` or `C:\ProgramData\ssh\administrators_authorized_keys` (checkers; KQL Q6).
2. **Persistence**: `com.apple.sysmond` LaunchAgent, `.smt` / `.smtk` / `smt.cmd` / `smtk`, `.stk_<10 hex>`, task `SysMon`, Startup `sysmon.cmd`, and any cron entry referencing them (checkers; KQL Q5-Q7; Sigma file and process rules).
3. **Connections**: anything to `134.209.82.225` (any port), port 8099, and unusual outbound 22 (KQL Q1, Q2, Q9; Sigma network and proxy rules).
4. **Tunnel processes**: `ssh -R` / `autossh -M 0` with the published options, retrying about every 60 seconds (checkers; KQL Q3, Q4).

If you find any:

- **Isolate** the device (Defender "Isolate device"); do not wipe it.
- **Preserve evidence**: copies of `authorized_keys`, the LaunchAgent / task / Startup script / cron spool, `~/.config`, temp `.stk_*` files, the extension folder, editor logs, and a triage image.
- **Remove** with Cursor's scripts from the [security notice](https://cursor.com/blog/claude-code-extension-security-notice): `remediate-macos.sh` as the affected user, `remediate-windows.ps1` elevated. They exit non-zero if anything remains. For Linux there is no Cursor script: remove the key, cron entry, files and processes by hand using the indicators above, and record what you removed.
- **Uninstalling the extension is not enough**: the payload drops standalone scripts that keep running.
- **Consider a rebuild**, especially where SSH was actually enabled (admin-started editors, Linux hosts with sshd running) since the attacker may have logged in.
- **Rotate credentials and sessions** reachable from the host (cloud keys, Git tokens, SSH keys, CI secrets, browser and SaaS sessions) **from a trusted machine**. Env-var names alone tell an attacker which secrets exist.

## Patched does not mean clean

Updating to 2.1.314 replaces the extension code; it does not remove the planted key, the LaunchAgent / task / Startup script, the `.smt` loops or the tunnel key files. Every device that had 2.1.313 must be checked and cleaned, whatever version it runs now.

## Files

| Path | What it is |
|---|---|
| `scripts/check-claude-code-ext.sh` | Bash checker for macOS and Linux (bash 3.2+). Read-only and offline |
| `scripts/Check-ClaudeCodeExt.ps1` | PowerShell checker for Windows (PowerShell 5.1 and 7). Read-only and offline |
| `kql/claude-code-ext-hunting.kql` | Defender XDR / Sentinel hunting queries Q1-Q9 |
| `sigma/*.yml` | 8 Sigma rules: network, proxy, reverse tunnel, editor persistence (Windows, macOS, Linux), payload files, authorized_keys by editor |
| `tests/run_tests.sh`, `tests/Check-ClaudeCodeExt.Tests.ps1` | Bash and Pester suites with mocked home trees built at run time |

## Checker usage

Both checkers are **strictly read-only and offline**: they list folders, read files and list processes (and, on Windows, read scheduled tasks with `Get-ScheduledTask`). They never connect to `134.209.82.225` or anywhere else, never write, move or delete anything, never remove keys, tasks, cron entries or LaunchAgents, and never run Cursor's remediation scripts.

```bash
bash scripts/check-claude-code-ext.sh                 # current user
sudo bash scripts/check-claude-code-ext.sh --all-users # every home under /Users and /home, plus /root
bash scripts/check-claude-code-ext.sh --home /mnt/image/Users/alice --ps-file ./ps.txt --cron-dir /mnt/image/var/spool/cron
```

```powershell
powershell -ExecutionPolicy Bypass -File .\Check-ClaudeCodeExt.ps1            # current user
powershell -ExecutionPolicy Bypass -File .\Check-ClaudeCodeExt.ps1 -AllUsers  # elevated: every profile in C:\Users
.\Check-ClaudeCodeExt.ps1 -HomeDir D:\image\Users\alice -ProgramDataSsh D:\image\ProgramData\ssh -TaskFile .\tasks.txt -ProcessFile .\procs.txt
```

What they check, per profile: `anthropic.claude-code-*` folders in `.cursor`, `.cursor-server`, `.vscode`, `.vscode-insiders`, `.vscode-server`, `.vscode-oss`, `.windsurf`, `.vscodium`, `.trae`, `.kiro` (flagging 2.1.313, and scanning `extension.js` for the IOCs); `authorized_keys` (and `administrators_authorized_keys` on Windows) for `svc-telemetry`, the key blob or the IP; `known_hosts` for the IP (plaintext entries only; hashed entries are not checked); payload files; LaunchAgents and Startup scripts referencing IOCs; the crontab spool (or `crontab -l` for the current user); `.stk_` files in temp; scheduled tasks (`SysMon` or IOC references); running ssh/autossh processes with `-R` or the IP.

| Verdict | Exit |
|---|---|
| CLEAN | 0 |
| INDICATORS FOUND (also when 2.1.313 is present) | 1 |
| UNKNOWN (a location could not be read; re-run as root / elevated) | 2 |
| error (bad arguments, missing paths) | 3 |

Both print the advice to update to 2.1.314+ and use Cursor's removal scripts.

## Tests

`bash tests/run_tests.sh` runs the bash cases, sandbox runs under `bwrap` (read-only root file system, no network namespace) for both checkers, a before/after checksum of the fixture tree, static checks for network / write commands, shellcheck, PSScriptAnalyzer, the Pester suite, `sigma check` and Kusto conversion of every rule. Tools are expected under `~/tools`.

## Sources

- Cursor, "Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace", 29 Oct 2026: https://cursor.com/blog/claude-code-extension-security-notice (primary; IOCs and remediation scripts)
- Open VSX, Anthropic.claude-code: https://open-vsx.org/extension/Anthropic/claude-code
- Visual Studio Marketplace, Claude Code: https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code
- Anthropic, Claude Code changelog and release v2.1.314: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md, https://github.com/anthropics/claude-code/releases/tag/v2.1.314
- The Hacker News, "Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor", 30 Oct 2026: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html (news)