DEV Community

Abdul Rehman
Abdul Rehman

Posted on Originally published at syntaxradar.com AI-assisted

Claude Code for VS Code 2.1.313 backdoor: how to check your machine and clean up

#security #vscode #ai #devtools

Security firm Phorion published an advisory on October 30, 2026 saying that release 2.1.313 of Claude Code for VS Code, as served through the Cursor Marketplace, carried a hidden backdoor. Cursor has pulled the release, and the advisory says the NPM and VS Code versions of 2.1.313 were pulled too. Uninstalling the extension does not remove what it installed. Phorion is the only primary source so far, so every technical detail below is its finding.

What the code did

Phorion found an extra block of code inserted at the top of extension.js. Because it sat above everything else, it ran as soon as Node loaded the file, before the extension's activate function and without any prompt.

  1. A spare login key. It appended an Ed25519 SSH key labelled svc-telemetry to ~/.ssh/authorized_keys.
  2. A tunnel that dials out. It opened an SSH connection to 134.209.82[.]225 on port 22 as user tunnel, with a reverse tunnel (-R *:0:localhost:22), so the attacker's server could reach your own SSH service. The key it used was stored at $TMPDIR/.stk_ plus 10 hex characters.
  3. A beacon. It sent one HTTP POST to /beacon on port 8099 of the same address with your hostname, username, platform, CPU architecture, Git email, public IP and the names of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.

Why removing the extension is not enough

Per Phorion, it installed persistence on every major desktop system, and it retries the connection every 60 seconds:

  • macOS: a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, plus ~/.config/.smt and .smtk.
  • Linux: an @reboot cron entry.
  • Windows: a scheduled task named SysMon, or a sysmon.cmd file in the Startup folder.

How to check

Run these on any machine that had 2.1.313 installed in Cursor or VS Code:

grep svc-telemetry ~/.ssh/authorized_keys
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt* 2>/dev/null
crontab -l | grep @reboot
ls -la "$TMPDIR"/.stk_* /tmp/.stk_* 2>/dev/null
ps aux | grep -E "autossh|ssh .*tunnel@" | grep -v grep
Enter fullscreen mode Exit fullscreen mode

On Windows, look for the SysMon task in Task Scheduler and sysmon.cmd in the Startup folder. Phorion also lists the SHA-256 of the backdoored extension.js (ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15) and the key fingerprint (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk). In SSH logs, a login from 127.0.0.1 or ::1 using the svc-telemetry key means someone came back through the tunnel.

Cleanup, in Phorion's order

  1. Stop the retry loop and kill any SSH or autossh processes it started.
  2. Remove the LaunchAgent, ~/.config/.smt and .smtk (or the cron entry, scheduled task or sysmon.cmd).
  3. Delete the svc-telemetry line from ~/.ssh/authorized_keys and remove /tmp/.stk_*.
  4. Confirm Remote Login is off on macOS.
  5. Rotate credentials if SSH was enabled or you suspect an inbound login.

One addition: if the beacon could have listed token or cloud key names from your environment, rotate those keys too.

Phorion also notes a logic bug on macOS: without admin rights, systemsetup -getremotelogin errors but still reports success, so the step that would switch on Remote Login was skipped. The outbound beacon is unaffected, so do not treat that as a free pass.

The original on SyntaxRadar adds a FAQ on whether the extension is safe now and how to vet AI coding extensions: https://syntaxradar.com/radar/claude-code-extension-vscode-backdoor

Top comments (0)