Your editor extensions have production access now

On 30 October, Phorion published an advisory about the official Claude Code for VS Code extension on the Cursor Marketplace. Versions 2.1.312 and 2.1.313 carried a prepended payload that ran the moment Node loaded the file. Cursor has pulled both versions. If you're a small team, the uncomfortable part is that the laptop running that extension is probably also the laptop with your Stripe key, your cloud CLI login, and push access to main.

What the payload did

The Phorion write-up is detailed and worth reading in full. The short version:

1. It appended an attacker's Ed25519 public key (comment svc-telemetry) to ~/.ssh/authorized_keys.
2. It opened an outbound reverse SSH tunnel so the operator could reach your local port 22 without any inbound firewall rule.
3. It set up persistence: a user LaunchAgent named com.apple.sysmond.plist on macOS, an @reboot cron entry on Linux, a SysMon task or Startup script on Windows.
4. It sent a beacon with your hostname, git email, public IP, and the names (not values) of up to 40 environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP.

That last one is the tell. The operator wanted a shopping list of which machines hold cloud credentials. On a big company laptop that list is long and mostly guarded by SSO. On a founder's laptop it's often STRIPE_SECRET_KEY, AWS_ACCESS_KEY_ID and a long-lived GitHub token, all in one .env.

Phorion also found a bug: on macOS, as a standard user, the check for Remote Login reads an admin error instead of "Off", so the script never tries to turn SSH on. If Remote Login was already enabled, that doesn't help you. Don't plan around an attacker's typo.

Check this today

If anyone on your team used Cursor with that extension in late October, uninstalling it is not enough. The cleanup list from the advisory, condensed:

• Look for svc-telemetry in ~/.ssh/authorized_keys, and compare key fingerprints too, since the comment is easy to change.
• Look for ~/.config/.smt, ~/.config/.smtk, and $TMPDIR/.stk_* files.
• On macOS, check ~/Library/LaunchAgents/ for com.apple.sysmond.plist. Apple doesn't put its own agents in your home folder.
• Check crontab -l for an @reboot line you didn't write.
• Check System Settings for Remote Login, and SSH logs for logins from 127.0.0.1 with that key.
• If SSH was on or you see a login, rotate everything that user could read. Start with payment keys and cloud credentials.

Habits that make the next one boring

This won't be the last poisoned extension. Marketplaces are a distribution channel, and distribution channels get attacked. A few cheap habits shrink the blast radius without buying anything.

Keep secrets out of your shell environment. The beacon only read variable names, but those names were the targeting data. Load secrets per command (op run, doppler run, aws-vault exec) so they exist for the process that needs them and not for every extension host.

Use restricted keys wherever the provider lets you. Stripe restricted keys, scoped GitHub fine-grained tokens, short-lived cloud sessions. A read-only key that leaks is an incident report. A full secret key that leaks is a very bad week. This is the same reason Dealpuffin asks founders for a read-only restricted key and never a secret key.

Pin and slow down extension updates. Turn off auto-update for extensions that can execute code, and let a new version sit for a few days before you take it. Most marketplace compromises get caught by someone else within 48 hours. Being a few days behind is a fair trade.

Give agents their own keys. If you run coding or ops agents, give each one a separate token with only the tools it needs, so you can revoke one without rotating everything. Our API keys and OAuth page shows how we split scopes per agent, and the pattern works anywhere.

Treat the laptop as a server. Disable Remote Login if you don't use it. Watch for new files in ~/Library/LaunchAgents. If you have a fleet of three, a weekly five-minute check is enough.

Frequently asked questions

Which versions were affected?

Claude Code for VS Code 2.1.312 and 2.1.313 as distributed on the Cursor Marketplace, per Phorion's advisory and Cursor's notice. Cursor removed both.

Did the malware steal secret values?

The beacon sent environment variable names, not values. But an operator with an SSH shell on your machine can read anything your user can, so if the tunnel was usable, assume the values are exposed too.

Is uninstalling the extension enough?

No. The SSH key, persistence script and LaunchAgent or cron entry survive uninstalling. Remove each one and then decide on rotation.

Related on Dealpuffin

How we think about permissions when founders connect billing: Connect Stripe and Proof points. For agent setups: Install the skill.