---
title: A developer installed a malicious editor extension (e.g., trojanized Claude Code 2.1.313): find it, remove persistence, rotate what it could reach | ctxsec
url: https://ctxsec.com/playbooks/malicious-ide-extension-backdoor-response
---

[← Playbooks](/playbooks)

# A developer installed a malicious editor extension (e.g., trojanized Claude Code 2.1.313): find it, remove persistence, rotate what it could reach

For extension-borne backdoors like the Oct 29 Cursor marketplace incident. The extension runs with the developer's permissions, so check for SSH keys, login items and tunnels, not just the extension folder.

For: SOC, IT / endpoint, Engineering managers

[1. Scope](#s1)[2. Check each host](#s2)[3. Contain and clean](#s3)[4. Rotate](#s4)[5. Harden](#s5)

1.

Step 1 of 5

__

### Scope

Find who had the bad version.

   - Query extension inventories or EDR for the extension folder and version (for 2.1.313: ~/.cursor/extensions/anthropic.claude-code-2.1.313-*)
   - Match install or update times against the vendor's exposure window
   - Search network logs for the published C2 IPs and ports

2.

Step 2 of 5

__

### Check each host

Look for what the payload leaves behind.

   - grep for the attacker key comment in ~/.ssh/authorized_keys and administrators_authorized_keys
   - List new LaunchAgents, scheduled tasks, Startup items and @reboot cron entries
   - Look for running ssh/autossh reverse tunnels (-R) with host-key checking disabled

3.

Step 3 of 5

__

### Contain and clean

Uninstalling the extension is not enough.

   - Isolate hosts with evidence of execution
   - Run the vendor's remediation script or remove keys, persistence and processes by hand, then verify nothing remains
   - Update to the clean version or remove the extension; rebuild if integrity is in doubt

4.

Step 4 of 5

__

### Rotate

Assume anything reachable from the account was exposed.

   - From a clean machine, rotate SSH keys, cloud keys, Git tokens and API keys available on the host
   - Revoke active sessions and review recent use of those credentials

5.

Step 5 of 5

__

### Harden

Shrink the next one.

   - Keep inbound SSH disabled on developer laptops unless required
   - Alert on editor processes writing authorized_keys or creating login items
   - Pin and stage updates for high-privilege extensions

Original content by ctxsec. Printable checklist: use your browser's print view.