Claude Code 2.1.313 Risk Starts on the Editor PC

On October 29, 2026, OpenSourceMalware reported that Claude Code extension build 2.1.313 reached the Cursor Marketplace carrying an SSH backdoor inside a package that identified itself as Anthropic's. Claude Code 2.1.313 risk sits on the laptop that edits the site: if that PC installed the build, the passwords for your site may already sit on a machine an outsider can reach.

Could Claude Code 2.1.313 put your website at risk?

Yes. Claude Code 2.1.313 risk sits on the computer that already holds your site’s SSH, SFTP, panel, and database passwords. The package never had to log into WordPress or Joomla to create that exposure.

OpenSourceMalware dated the malicious publish to October 29, 2026. The extension identified itself as Anthropic’s product: package name claude-code, extension ID anthropic.claude-code, version 2.1.313, publisher Anthropic, display name “Claude Code for VS Code.” The manifest required a VS Code engine of ^1.94.0. The package the researchers compared listed TargetPlatform darwin-arm64. The same loader behavior was written to run on Linux and Windows as well.

No CVE, CVSS score, threat actor, or victim count was published. This is a trojanized supply-chain artifact with a persistent SSH backdoor, so a WordPress or Joomla update removes nothing from the laptop and leaves any tunnel that machine already opened.

VS Code-compatible editors run extensions in a local extension-host process with the operating-system rights of the person logged into the laptop. Loading the module was enough to start the loader. A conversation with Claude was not required. The package declared no install, build, prepare, preinstall, or postinstall scripts, so the behavior happened at extension runtime.

The initial account blamed an Open VSX copy and said victims were hit during an auto-update. Cursor then contacted OpenSourceMalware and said the bad build was in the Cursor Marketplace and came from Cursor’s own mirror of the Open VSX registry, not from Open VSX itself. That origin claim is Cursor’s statement, relayed by the researchers. OpenSourceMalware also wrote that provenance of the analyzed directory was not established. The artifact they inspected is malicious. The same write-up does not prove Anthropic’s release pipeline was breached.

What changed inside the Cursor Marketplace build?

The Cursor Marketplace build matched the real Claude Code extension except for a loader placed at the front of extension.js, so it ran as soon as the editor loaded the module. OpenSourceMalware says the unpacked extension and the bundled binary were the official ones. The differences were package.json and version metadata, the extension.js entry point, and a differently named .vsixmanifest.

The loader was an immediately invoked block of about 66 lines, prepended ahead of the legitimate bundle. It imported Node’s process, filesystem, operating-system, HTTP, and cryptographic modules, then finished before the expected extension code began. The researchers also described a heavily obfuscated JavaScript section beginning around line 69 of that same file. The clear block made no attempt to hide an SSH reverse shell and a data send. The obfuscated block followed it. This stage still did not download a second executable. Nearly every exception in the loader was suppressed, so the legitimate extension could still finish loading. A successful Claude chat after October 29 does not clear the machine.

The source says 2.1.312 had shipped a few days before October 29. At analysis time, Open VSX, the @anthropic-ai/claude-code NPM package, and the Microsoft VS Code Marketplace showed 2.1.314 as current and did not list 2.1.313. Researchers first read that gap as a removal. The later update tied version 2.1.313 to the Cursor Marketplace and to Cursor’s Open VSX mirror. Those other channels were reported clean. A clean listing on the Microsoft marketplace does not prove the copy installed in a developer’s Cursor profile is clean. Compare the version string on that profile.

Hashing the bundled binary and treating a match as proof of a clean install fails here: the binary was the official one. The tells are the JavaScript entry point, the version string 2.1.313 from Cursor, and whatever the loader wrote under the user profile. The .vsixmanifest in the analyzed 2.1.313 package sat in a different place and under a different name than the usual extension.vsixmanifest in 2.1.312. The content change the researchers called out was the version number itself, set to 2.1.313, with publisher Anthropic and a public gallery flag.

Why is the laptop that publishes your site now in scope?

The loader tried to map the developer machine, add an SSH key, hold a reverse tunnel open, and keep that tunnel running. That is the same class of access a publisher already has on a live site.

Reconnaissance collected the hostname, local username, operating system, CPU architecture, home directory, and current working directory. It read the global Git email with git config –global user.email. That email often matches the address on hosting tickets and Git commits. It also took the names of up to 40 environment variables whose names contained KEY, TOKEN, SECRET, PASS, AWS, or GCP. Variable values were not placed in the first beacon. Names can still show which cloud accounts, CI systems, and credential types that laptop was built to use. If SSH access succeeded, the operator could read the account directly, values included. The first beacon carried names, so the operator still needed a shell to read the values.

The implant created ~/.ssh with mode 0700, appended an Ed25519 public key labeled svc-telemetry to ~/.ssh/authorized_keys, set that file to mode 0600, and skipped a second append if the marker was already there. The comment is meant to look like an administrative telemetry account. A public key in authorized_keys lets the holder of the matching private key log in as the account that owns the file, within sshd rules and any restrictions on that account. On its own, it does not grant root or SYSTEM access. A developer account is still enough when that account can reach the theme directory, wp-config.php, the hosting panel, and the Git remote that deploys the site.

The next step tried to enable the local SSH service. On macOS it checked Remote Login and, if that was off, tried to enable it with systemsetup through sudo in non-interactive mode. On Linux it checked sshd or ssh with systemctl, then tried several service-start commands. On Windows it used PowerShell to install OpenSSH Server, set it to start automatically, and start sshd. Success depended on the operating system and on privileges. The key can still be written when the service-start command fails. Writing authorized_keys usually needs only the logged-in user’s rights. Installing OpenSSH Server usually needs elevation.

The reverse tunnel is built to work from inside the network. The loader decoded an embedded OpenSSH private key into a temporary file whose name starts with .stk_ plus an identifier taken from the hostname and home directory. It connected outbound as the user tunnel. The forwarding request asked the far side to allocate a port and send those connections back to the laptop’s port 22. It reconnected after 60 seconds, turned off host-key verification, ignored the user’s known-hosts file, and used only the embedded identity. On Unix-like systems it preferred autossh and otherwise used ssh. Because the persistent connection starts on the victim machine, a NAT router that blocks unsolicited inbound connections does not, alone, remove this path. The laptop dials out. The tunnel still needs a local SSH service and working forwarding. No second-stage file had to be downloaded for that route to exist.

The implant also sent a reconnaissance beacon over plain HTTP to an operator-controlled host on port 8099. The same stage’s HTTP requests retrieved only public-IP text. Plain HTTP has neither transport encryption nor authenticated TLS, so proxy, firewall, and DNS logs can still record the attempt. Pair that HTTP attempt with an outbound SSH session from the same user. A review that only watches for inbound connections will miss a reverse tunnel the laptop opened itself. NPM supply-chain malware and how attackers find a weak website usually start with that kind of access, not with a zero-day in the theme.

What should you remove if version 2.1.313 was installed?

Work in this order: confirm the version, preserve the folder, remove the authorized key, kill the tunnel, delete the startup files you can tie to this build, then rotate every credential that laptop could reach.

Check identity with cursor –list-extensions –show-versions and filter for anthropic.claude-code. If the Cursor command-line tool is missing, use the Extensions panel and the folder on disk. Typical Cursor installs keep extensions under ~/.cursor/extensions/. Confirm that path on the machine. Other VS Code-compatible installs use ~/.vscode/extensions/. Write down the version, the marketplace the developer names, and the folder timestamps before anything is deleted. Version 2.1.313 is the build in this report. Seeing 2.1.312 or 2.1.314 from Microsoft’s marketplace or from Open VSX is a different fact from seeing 2.1.313 inside Cursor. Preserve the extension folder, package.json, the manifest, and timestamps before anyone uninstalls the extension or upgrades Cursor.

1. Search ~/.ssh/authorized_keys for the comment svc-telemetry and remove that line. Read every other unexpected key added around October 29.
2. Check SSH authentication logs for logins you did not make, and for outbound sessions started by this laptop toward an operator host.
3. Stop any autossh or ssh process that is holding a reverse forward to local port 22, including a reconnect loop of about 60 seconds.
4. On macOS, remove ~/Library/LaunchAgents/com.apple.sysmond.plist and the files ~/.config/.smt and ~/.config/.smtk, then unload the agent so it does not restart.
5. Search the user profile for a temporary private-key file whose name starts with .stk_. Quarantine it with the extension directory. Do not email the file around as a sample.
6. Rotate every password, key, token, and panel login that this account could use, including SFTP, Git, database, and hosting.

On macOS, the researchers say .smt reconstructs the private key material and keeps launching the tunnel. The LaunchAgent name com.apple.sysmond.plist is chosen to resemble an Apple system monitor. It is not an Apple binary. The published analysis cuts off before the plist keys are quoted, so remove the agent file itself. The write-up says the loader has platform branches for Linux and Windows and spells out the SSH-enable commands on both. It does not, in the text available for this report, finish the Linux and Windows persistence file names. Still search the user crontab, Startup folder, and scheduled tasks for anything added after October 29 that relaunches ssh. A LaunchAgent, a cron line, or a Startup entry can remain after Cursor is upgraded or the extension is removed.

What should a site owner rotate if Cursor edited the site?

Rotate the credentials that laptop could reach, then watch the site for changes those credentials could have made. Cleaning the editor and cleaning the website are both required when the account was a path to production.

Start with SSH and SFTP passwords and any private keys stored on that machine, including keys loaded in an agent. Then change the hosting-panel password, the WordPress or Joomla administrator passwords that were saved in the editor or in a local password store, and the database user in wp-config.php if that file was on the laptop. Rotate Git credentials and deploy keys for the remote that publishes the site. Revoke personal access tokens, application passwords, and cloud keys whose names appeared in the environment, especially anything matching AWS, GCP, TOKEN, SECRET, or PASS. The beacon carried names, so assume the operator knew where to look if the tunnel came up.

Check the site itself for new administrator users, changed email addresses, unexpected plugins or templates, and files modified after October 29 that the developer does not recognize. A backdoored editor can upload a webshell or change a theme file without tripping a CMS vulnerability scanner. Review hosting and panel logs for logins from new addresses, and for SFTP sessions outside the developer’s normal hours. On the laptop, the matching question is whether sshd accepted a key you did not issue.

After the passwords are new, put file-integrity monitoring on the document root so a second upload from a leftover key is visible. Website antivirus protection is the ongoing check for that second upload, once the editor key and the panel password are already changed. If the developer also kept mailbox passwords on the same profile, reset those too. Email forwarding rules and panel recovery addresses are a common way back in after the SSH key is deleted.

FAQ

Was the Claude Code extension hacked?

OpenSourceMalware reported a malicious build, version 2.1.313, in the Cursor Marketplace on October 29, 2026. It identified itself as Anthropic's claude-code extension. The researchers said the artifact is malicious and that their findings do not prove Anthropic's own distribution was compromised.

Is Claude Code 2.1.313 safe to install?

No. That version is the Cursor Marketplace build this report calls malicious. At analysis time the NPM package, Open VSX, and the Microsoft marketplace had moved from 2.1.312 to 2.1.314 and did not list 2.1.313.

Did the Cursor Marketplace get compromised?

Cursor told OpenSourceMalware that the Claude Code extension in the Cursor Marketplace was compromised and that the bad build came from Cursor's mirror of Open VSX, not from Open VSX itself. The analyzed directory's provenance was not established.

How do I know if I installed a fake Claude Code extension?

In Cursor, check anthropic.claude-code for version 2.1.313. Then look for an authorized_keys line commented svc-telemetry, a LaunchAgent named com.apple.sysmond.plist, files ~/.config/.smt and ~/.config/.smtk, and a temp file whose name starts with .stk_.

If a developer laptop with this build could reach your site, rotate the access and have the files checked for a second upload. A website protection package adds a firewall and monitoring after those credentials are already changed.