Security firm Phorion has identified a supply-chain compromise of the official Claude Code for VS Code extension distributed through the Cursor Marketplace. Version 2.1.313 of the extension bundle contained an injected immediately invoked function expression (IIFE) that executed before the extension's normal activation callback, requiring zero user interaction to fire. The payload planted an attacker-controlled Ed25519 public key in the victim's ~/.ssh/authorizedkeys, established a reverse SSH tunnel to 134.209.82.225, and set up platform-specific persistence mechanisms — a LaunchAgent on macOS, a crontab @reboot entry on Linux, and attempted PowerShell-based OpenSSH Server installation on Windows. The attack's architecture is straightforward but effective: two SSH keys serve distinct roles. The public key dropped into authorizedkeys (comment: svc-telemetry) enables inbound access to the victim machine. A separate embedded private key (comment: svc-telemetry-tun) authenticates the outbound tunnel connection to the attacker's server. The tunnel uses remote port forwarding with dynamic port allocation (-R :0:localhost:22), allowing the operator to route back through the tunnel to the victim's local SSH daemon at will. Phorion discovered a significant implementation bug on macOS that limits the implant's effectiveness. The malware runs systemsetup -getremotelogin without root privileges to check whether Remote Login (SSH) is enabled. Without elevation, macOS returns an administrator-access error and exits with status 0 — not the string "Off" the script tests for. The regex /Off/i.test(rl) evaluates to false, so the script skips the enablement step entirely. It treats "I can't check" as "SSH is already on." On Macs without Remote Login already enabled, the inbound access path is broken even though the keys and persistence artifacts are still dropped. The Windows path carries its own bug: the PowerShell service-setup command is routed through a helper function that hardcodes /bin/sh as the shell, which obviously fails on Windows. None of the platform paths include privilege escalation exploits — non-interactive sudo (sudo -n) will fail unless the user has passwordless sudo cached. The Linux crontab logic contains a separate bug that can wipe existing user cron jobs on repeated runs. Persistence is the payload's core objective. On macOS, a LaunchAgent plist (com.apple.sysmond.plist) is installed with RunAtLoad and KeepAlive set to true. On Linux, a shell script at ~/.config/.smt recreates the tunnel key and loops the SSH connection, anchored by a crontab @reboot entry. The tunnel retry loop sleeps 60 seconds between attempts and uses pgrep to avoid duplicate connections. Because the loop detaches from the IDE process, closing Cursor does not kill the tunnel. Cursor has pulled version 2.1.313 from its marketplace and removed the corresponding NPM and VS Code registry entries. Organizations running this version should treat it as a confirmed compromise and engage incident response. Indicators include the svc-telemetry comment string in authorizedkeys (though hunting by public-key fingerprint is more reliable), the .stk prefixed key file in the OS temp directory, the LaunchAgent plist on macOS, and outbound SSH connections to 134.209.82.225. The episode exposes the structural fragility of IDE extension ecosystems. Extensions execute with the full permissions of the IDE and its user — file access, source code, developer tooling, credentials. A single compromised package in a marketplace with limited code-signing and review infrastructure gives an attacker immediate, persistent access to the most sensitive machines in any engineering organization. The bugs in this particular implant are lucky breaks, not defenses.
