安全公司发现Cursor市场官方Claude Code扩展植入恶意后门

据安全公司Phorion披露，Cursor Marketplace上发布的官方“Claude Code for VS Code”扩展（版本2.1.313）中嵌入了一个严重的安全后门 1。该恶意代码能够在macOS、Linux和Windows三大主流操作系统上建立持久化的SSH访问权限，并通过反向隧道将受害者的主机侦察信息回传至攻击者控制的服务器 1。

具体而言，后门程序会在用户的~/.ssh/authorized_keys文件中注入名为“svc-telemetry”的攻击者公钥，从而获取远程登录能力 1。在通信方面，受感染的主机会通过反向SSH隧道连接至IP地址134.209.82[.]225的22端口，并向同一IP的8099端口发送HTTP POST信标以汇报状态 1。为了确保持久驻留，攻击者在不同平台上采用了特定的隐藏机制：在macOS上使用伪装成com.apple.sysmond.plist的LaunchAgent；在Linux上使用@reboot cron任务；而在Windows上则创建名为SysMon的计划任务 1。尽管macOS上的部分逻辑存在缺陷可能导致无法自动开启SSH服务，但已植入的密钥及持久化结构依然构成重大威胁 1。

在数据窃取层面，该扩展会收集包括主机名、用户名、操作系统平台、Git邮箱配置、公网IP以及匹配“KEY|TOKEN|SECRET|PASS|AWS|GCP”正则表达式的环境变量名称等信息，但值得注意的是，它仅记录变量名而不收集具体的变量值 1。针对这一情况，Cursor官方已采取处置措施，从Marketplace移除该发布版本，并从NPM注册表及VSCode注册表中拉取相关受影响版本 1。

Security firm Phorion identified a malicious backdoor within the official "Claude Code for VS Code" extension, specifically version 2.1.313, which was distributed via the Cursor Marketplace 1. The compromised software establishes persistent Secure Shell (SSH) access across macOS, Linux, and Windows environments by injecting an attacker's public key labeled "svc-telemetry" into the ~/.ssh/authorized_keys file 1. This unauthorized access enables remote control and data exfiltration through reverse SSH tunnels connected to IP address 134.209.82[.]225 on port 22, alongside HTTP POST beacons sent to the same IP on port 8099 1.

The malware employs platform-specific mechanisms to maintain persistence after system reboots or restarts 1. On macOS, it disguises itself as a LaunchAgent using a plist file named com.apple.sysmond.plist, while on Linux it utilizes @reboot cron jobs, and on Windows it creates scheduled tasks under the name "SysMon" 1. Although flawed logic on macOS may prevent the automatic activation of the SSH service, the implanted keys and persistence structures still pose a severe security threat 1. The extension also harvests host reconnaissance information, including hostname, username, OS platform, Git email, public IP, and environment variable names matching patterns such as KEY, TOKEN, SECRET, PASS, AWS, or GCP, though it does not collect the values of these variables 1. In response to the discovery, Cursor has removed the offending version from its marketplace and pulled related releases from both NPM and the VSCode registry 1.