Malicious Claude Code Extension in Cursor and VS Code: How to Check and Remove It

Updated on October 31, 2026: we corrected the names of the persistence files and the format of the malicious key, and added ready-to-use check commands and the official remediation scripts.

The recent incident involving the Claude Code extension on the Cursor marketplace for VS Code is an important alert for the entire developer community using AI-powered editors. More than an isolated problem, the case reinforces the need to bring security practices into the workflow, regardless of experience level. In this guide, Hcode clearly explains what happened, how to identify whether your environment was affected, and what practical steps to take to remediate and strengthen security.

The Claude Code Incident: What happened?

On October 29, 2026, between 2:27 AM and 1:35 PM Pacific Time (roughly 9:27 to 20:35 UTC), two malicious versions of the Claude Code extension (2.1.312 and 2.1.313, for Windows and macOS) were made available on Cursor's extension marketplace. These versions were not developed by the original developer of the extension: this was tampering in the distribution channel. Below, we break down the key points of the incident to make it easier for developers to understand and analyze:

How was the extension compromised?

• Malicious code was injected into the extension's main file (extension.js) and distributed as if it were a legitimate update. It ran as soon as the editor loaded the extension, with no user interaction.
• Early reports mentioned Open VSX, but later analyses indicate that the malicious distribution happened through the Cursor marketplace. There is no indication that it reached the official VS Code marketplace.

What did the malicious code do?

• It collected and sent machine information to the attacker: hostname, username, operating system, architecture, home folder, working directories, environment variable names (without their values), configured Git email and public IP.
• It added an attacker-controlled SSH key, labeled svc-telemetry, to the user's authorized_keys file.
• It attempted to enable the local SSH service and open a reverse SSH tunnel to the attacker's server (134.209.82.225).
• It installed persistence to keep the tunnel alive, retrying every 60 seconds: a LaunchAgent disguised as a system service (com.apple.sysmond) on macOS, and a scheduled task named SysMon, with a startup script as a fallback, on Windows.

Impact and response

• Enabling the SSH service requires administrator privileges, which the extension usually did not have. As a result, on most machines the attacker could not access the computer through the tunnel.
• Even so, the SSH key was added, persistence was installed and machine data was sent. Cleanup is required on any affected machine.
• The attacker's server has been taken down, so the tunnel and the data upload no longer work.
• The malicious version was removed and replaced by 2.1.314. According to Help Net Security, up to about 5,000 users may have received the tampered version.

For Hcode, the incident shows how supply chain attacks can compromise even popular tools and reinforces the value of continuous vigilance over extensions and dependencies.

How to know if you were affected?

Check your machine if you use Cursor, VS Code, Windsurf, VSCodium or any other editor with the Claude Code extension installed or updated on October 29. The main indicator is the presence of the svc-telemetry SSH key in the authorized_keys file, but the analysis should not stop there: the persistence files remain active even after the extension is removed.

Step by step to identify signs of compromise

The commands below take about 2 minutes. Paste one at a time.

Windows (PowerShell)

1. Look for the malicious key:

$f = "$HOME\.ssh\authorized_keys","C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }; if ($f -and (Select-String svc-telemetry $f)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

2. List the extension versions across all editors (.vscode, .cursor, .windsurf etc.):

Get-ChildItem "$HOME\.*\extensions" -Directory -Force -Filter "anthropic.claude-code-*" -ErrorAction SilentlyContinue | Select-Object FullName

3. Look for persistence:

Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue; Test-Path "$HOME\.config\smt.cmd"

macOS (Terminal)

1. Look for the malicious key:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

2. List the extension versions:

ls -d ~/.*/extensions/anthropic.claude-code-* 2>/dev/null

3. Look for persistence:

ls ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null

How to interpret the results

• Clean machine: the first command returns "No key found", no 2.1.312 or 2.1.313 folder shows up, and step 3 finds nothing (on Windows, only False appears). Just confirm that the extension is on version 2.1.314 or later.
• Compromised machine: the key showed up, or a 2.1.312/2.1.313 folder (even if you have already updated since), or the SysMon task or any of the persistence files. Proceed to remediation.

Remediation: How to eliminate the malicious Claude Code extension from your environment

Removing only the extension does not solve the problem, because the SSH key and persistence scripts remain active. Follow the steps below, in this order:

1. Isolate the machine

• Disconnect the computer from the network (Wi-Fi or cable), but do not shut it down.

2. Preserve evidence

• Before removing anything, take a screenshot of the check command results and copy the relevant logs. In companies, send this material to the security team before proceeding.

3. Run the official remediation scripts

Cursor published scripts that remove the malicious extension, the persistence mechanisms, the tunnel processes and the attacker's SSH key. If possible, download them on another computer and bring them to the affected machine.

• macOS: download remediate-macos.sh and run it as the affected user (not as root), from the folder where you saved it:

  bash remediate-macos.sh

• Windows: download remediate-windows.ps1 and run it in PowerShell opened as Administrator, from the folder where you saved it:

  powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

The scripts exit with an error if anything remains. After running them, repeat the check commands to confirm everything was removed.

4. Check the artifacts manually

If you prefer to validate item by item, or if the script reports that something was left behind, these are the artifacts published by Cursor:

• All systems: a line containing svc-telemetry in the authorized_keys file.
• macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt, ~/.config/.smtk and .stk_ files followed by 10 hex characters in the temporary folder ($TMPDIR).
• Windows: the SysMon scheduled task, %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, .stk_ files in %TEMP% and sysmon.cmd in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.
• Linux: an @reboot crontab entry that runs ~/.config/.smt, plus ~/.config/.smtk and /tmp/.stk_ files.
• Processes: ssh or autossh running with -N -R '*:0:localhost:22'.

5. Check whether there was access

• Search the SSH logs for logins from localhost that used the svc-telemetry key. If you find any, treat the case as a real compromise and consider reinstalling the system.

6. Rotate credentials and sessions

• From another clean machine, rotate GitHub and npm tokens, SSH keys, cloud and API keys (including secrets in .env files) and revoke open browser sessions. Data collection was limited, but that does not rule out later credential access through the backdoor.

7. Update the extension securely

• Only after the cleanup, install version 2.1.314 or later from the official marketplaces.

Practical examples: How to locate and remove malicious artifacts

Supporting commands to investigate each operating system, in addition to the official scripts:

macOS

• Check the malicious LaunchAgent: ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist
• Check tunnel processes: ps aux | grep -E "autossh|ssh -N -R" | grep -v grep
• Check connections to the attacker's server: lsof -nPi | grep 134.209.82.225

Windows

• Check the scheduled task: Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
• Check the startup script: Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
• Check SSH processes: Get-Process ssh -ErrorAction SilentlyContinue

Linux

• List the crontab: crontab -l | grep .smt
• Check connections: ss -tnp | grep 134.209.82.225
• Analyze logs: grep svc-telemetry /var/log/auth.log

Check the authorized_keys file

• Open ~/.ssh/authorized_keys (or %USERPROFILE%\.ssh\authorized_keys on Windows) and look for this exact line, which is the attacker's key:
  

  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry

  Also review whether there is any other key you do not recognize.

If you still have doubts about the cleanup, Hcode recommends considering reinstalling the system or restoring from trusted backups, especially in critical environments.

Common mistakes and how to avoid them

• Removing only the extension: the SSH key and persistence scripts remain active even after the extension is deleted.
• Searching for the wrong name: the persistence uses names that imitate legitimate services (com.apple.sysmond on macOS and SysMon on Windows). Searching only for "telemetry" will not find these files.
• Not rotating credentials: the collected data can be used in future attacks. Change passwords, keys and tokens used on the machine, even without evidence of malicious use.
• Cleaning up before preserving evidence: without the records, it becomes impossible to know whether there was actual access.
• Updating without cleaning artifacts: installing the safe version does not remove the key or the scripts already installed.
• Downloading cleanup scripts from unofficial sources: use only the scripts published by Cursor, linked above.

For Hcode, each of these oversights can keep the environment compromised for longer, making detection and response harder. Pay close attention at every step of the process.

Frequently asked questions

Which versions of the Claude Code extension were affected?

Versions 2.1.312 and 2.1.313 for Windows and macOS, distributed through the Cursor marketplace on October 29, 2026. Version 2.1.314 and later are safe.

Does removing the extension from VS Code eliminate the risk?

No. The SSH key and persistence scripts remain active. It is essential to run the remediation scripts and confirm the cleanup with the check commands.

What information may have been collected from my system?

Hostname, username, operating system, architecture, home folder, working directories, environment variable names (without the values), Git email and public IP.

Did the incident affect other marketplaces or extensions?

According to Cursor, there is no evidence that other versions of the extension, the official distribution or other extensions were affected. Researchers also found no indication that the malicious version reached the official VS Code marketplace.

Conclusion: Security is part of professional development

The case of the malicious Claude Code extension sends a clear message: taking care of security is not limited to source code, but involves monitoring extensions, reviewing startup scripts and keeping a routine of credential rotation. Hcode recommends that, in the face of any suspicion, developers follow the investigation and cleanup roadmap detailed in this guide, preserve evidence and, if necessary, rely on experts in their organization. Adopting these practices prevents bigger impacts and strengthens professional technical maturity. To go deeper into security and modern development, visit the Hcode course platform.

Sources

Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace, Cursor, October 29, 2026 (updated October 30).

Claude Code extension poisoned with persistent SSH backdoor, Help Net Security, October 30, 2026.

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor, The Hacker News, October 30, 2026.