# Claude Code for VS Code 2.1.313 backdoor: how to check your machine and clean up

> Source: <https://dev.to/abdul_rehman_90cb34d3a146/claude-code-for-vs-code-21313-backdoor-how-to-check-your-machine-and-clean-up-55k8>
> Published: 2026-10-31 08:15:04+00:00

Security firm Phorion published an advisory on October 30, 2026 saying that release 2.1.313 of Claude Code for VS Code, as served through the Cursor Marketplace, carried a hidden backdoor. Cursor has pulled the release, and the advisory says the NPM and VS Code versions of 2.1.313 were pulled too. Uninstalling the extension does not remove what it installed. Phorion is the only primary source so far, so every technical detail below is its finding.

Phorion found an extra block of code inserted at the top of `extension.js`. Because it sat above everything else, it ran as soon as Node loaded the file, before the extension's `activate` function and without any prompt.

`svc-telemetry` to `~/.ssh/authorized_keys`.` 134.209.82[.]225` on port 22 as user `tunnel`, with a reverse tunnel (`-R *:0:localhost:22`), so the attacker's server could reach your own SSH service. The key it used was stored at `$TMPDIR/.stk_` plus 10 hex characters.`/beacon` on port 8099 of the same address with your hostname, username, platform, CPU architecture, Git email, public IP and the names of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.
Per Phorion, it installed persistence on every major desktop system, and it retries the connection every 60 seconds:

`~/Library/LaunchAgents/com.apple.sysmond.plist`, plus `~/.config/.smt` and `.smtk`.`@reboot` cron entry.`SysMon`, or a `sysmon.cmd` file in the Startup folder.
Run these on any machine that had 2.1.313 installed in Cursor or VS Code:

```
grep svc-telemetry ~/.ssh/authorized_keys
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt* 2>/dev/null
crontab -l | grep @reboot
ls -la "$TMPDIR"/.stk_* /tmp/.stk_* 2>/dev/null
ps aux | grep -E "autossh|ssh .*tunnel@" | grep -v grep
```

On Windows, look for the `SysMon` task in Task Scheduler and `sysmon.cmd` in the Startup folder. Phorion also lists the SHA-256 of the backdoored `extension.js` (`ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`) and the key fingerprint (` SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk`). In SSH logs, a login from `127.0.0.1` or `::1` using the `svc-telemetry` key means someone came back through the tunnel.

`autossh` processes it started.`/tmp/.stk_*`.
One addition: if the beacon could have listed token or cloud key names from your environment, rotate those keys too.

Phorion also notes a logic bug on macOS: without admin rights, `systemsetup -getremotelogin` errors but still reports success, so the step that would switch on Remote Login was skipped. The outbound beacon is unaffected, so do not treat that as a free pass.

The original on SyntaxRadar adds a FAQ on whether the extension is safe now and how to vet AI coding extensions: [https://syntaxradar.com/radar/claude-code-extension-vscode-backdoor](https://syntaxradar.com/radar/claude-code-extension-vscode-backdoor)