Claude Code for VS Code 2.1.313 backdoor: how to check your machine and clean up
Security firm Phorion published an advisory on October 30, 2026 saying that release 2.1.313 of Claude Code for VS Code, as served through the Cursor Marketplace, carried a hidden backdoor. Cursor has pulled the release, and the advisory says the NPM and VS Code versions of 2.1.313 were pulled too.
Posted on Oct 31 • Originally published at syntaxradar.com • AI-assisted
Security firm Phorion published an advisory on October 30, 2026 saying that release 2.1.313 of Claude Code for VS Code, as served through the Cursor Marketplace, carried a hidden backdoor. Cursor has pulled the release, and the advisory says the NPM and VS Code versions of 2.1.313 were pulled too. Uninstalling the extension does not remove what it installed. Phorion is the only primary source so far, so every technical detail below is its finding.
Phorion found an extra block of code inserted at the top of extension.js. Because it sat above everything else, it ran as soon as Node loaded the file, before the extension's activate function and without any prompt.
Per Phorion, it installed persistence on every major desktop system, and it retries the connection every 60 seconds:
Run these on any machine that had 2.1.313 installed in Cursor or VS Code:
grep svc-telemetry ~/.ssh/authorized_keys ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt * 2>/dev/null crontab -l | grep @reboot ls -la " $TMPDIR " /.stk_ * /tmp/.stk_ * 2>/dev/null ps aux | grep -E "autossh|ssh.*tunnel@" | grep -v grep Enter fullscreen mode Exit fullscreen mode On Windows, look for the SysMon task in Task Scheduler and sysmon.cmd in the Startup folder. Phorion also lists the SHA-256 of the backdoored extension.js ( ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 ) and the key fingerprint ( SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk ). In SSH logs, a login from 127.0.0.1 or::1 using the svc-telemetry key means someone came back through the tunnel.
One addition: if the beacon could have listed token or cloud key names from your environment, rotate those keys too.
Phorion also notes a logic bug on macOS: without admin rights, systemsetup -getremotelogin errors but still reports success, so the step that would switch on Remote Login was skipped. The outbound beacon is unaffected, so do not treat that as a free pass.
The original on SyntaxRadar adds a FAQ on whether the extension is safe now and how to vet AI coding extensions: https://syntaxradar.com/radar/claude-code-extension-vscode-backdoor