Claude Code for VS Code 2.1.313 backdoor: how to check your machine and clean up

Security firm Phorion reported on October 30, 2026 that release 2.1.313 of Claude Code for VS Code, distributed through the Cursor Marketplace, contained a hidden backdoor inserted at the top of extension.js that executed on load without prompting. The malware added an SSH key to authorized_keys, opened a reverse tunnel to 134.209.82[.]225, beaconed host and environment data including token and cloud-key names, and installed persistence via LaunchAgents, cron and Windows startup entries; Cursor has pulled the release along with the NPM and VS Code versions, but uninstalling the extension does not remove what it installed. Phorion published detection commands, the backdoored file's SHA-256 and the key fingerprint so users can check affected machines and rotate exposed credentials.

Security firm Phorion published an advisory on October 30, 2026 saying that release 2.1.313 of Claude Code for VS Code, as served through the Cursor Marketplace, carried a hidden backdoor. Cursor has pulled the release, and the advisory says the NPM and VS Code versions of 2.1.313 were pulled too. Uninstalling the extension does not remove what it installed. Phorion is the only primary source so far, so every technical detail below is its finding. Phorion found an extra block of code inserted at the top of extension.js . Because it sat above everything else, it ran as soon as Node loaded the file, before the extension's activate function and without any prompt. svc-telemetry to ~/.ssh/authorized keys . 134.209.82 . 225 on port 22 as user tunnel , with a reverse tunnel -R :0:localhost:22 , so the attacker's server could reach your own SSH service. The key it used was stored at $TMPDIR/.stk plus 10 hex characters. /beacon on port 8099 of the same address with your hostname, username, platform, CPU architecture, Git email, public IP and the names of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. Per Phorion, it installed persistence on every major desktop system, and it retries the connection every 60 seconds: ~/Library/LaunchAgents/com.apple.sysmond.plist , plus ~/.config/.smt and .smtk . @reboot cron entry. SysMon , or a sysmon.cmd file in the Startup folder. Run these on any machine that had 2.1.313 installed in Cursor or VS Code: grep svc-telemetry ~/.ssh/authorized keys ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt 2 /dev/null crontab -l | grep @reboot ls -la "$TMPDIR"/.stk /tmp/.stk 2 /dev/null ps aux | grep -E "autossh|ssh . tunnel@" | grep -v grep On Windows, look for the SysMon task in Task Scheduler and sysmon.cmd in the Startup folder. Phorion also lists the SHA-256 of the backdoored extension.js ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 and the key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk . In SSH logs, a login from 127.0.0.1 or ::1 using the svc-telemetry key means someone came back through the tunnel. autossh processes it started. /tmp/.stk . One addition: if the beacon could have listed token or cloud key names from your environment, rotate those keys too. Phorion also notes a logic bug on macOS: without admin rights, systemsetup -getremotelogin errors but still reports success, so the step that would switch on Remote Login was skipped. The outbound beacon is unaffected, so do not treat that as a free pass. The original on SyntaxRadar adds a FAQ on whether the extension is safe now and how to vet AI coding extensions: https://syntaxradar.com/radar/claude-code-extension-vscode-backdoor https://syntaxradar.com/radar/claude-code-extension-vscode-backdoor