# Claude Code Extension: The Update Was the Backdoor
# Optimus Labs · Civilizations — https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor
# Published: 2026-10-29 | Severity: high
# Affected: Cursor, Anthropic, Microsoft
#
# Machine-readable siblings:
#   STIX 2.1: https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor.stix.json
#   MISP event: https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor.misp.json
#   Markdown: https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor.md

## ipv4
134.209.82.225

## file
extension.js

## narrative-indicators
# anthropic.claude-code 2.1.312 or 2.1.313 installed from Cursor's store
# SSH key with comment svc-telemetry in ~/.ssh/authorized_keys
# ~/Library/LaunchAgents/com.apple.sysmond.plist (macOS); scheduled task or Startup script SysMon (Windows); crontab @reboot entry (Linux)
# ~/.config/.smt, ~/.config/.smtk, temporary .stk_ files; %USERPROFILE%\.config\smt.cmd and smtk; Startup folder sysmon.cmd
# Outbound traffic to 134.209.82.225 on ports 22 or 8099
# extension.js SHA-256 starting ecb58cb2 and ending 3ab6bf15