Malicious Claude Code 2.1.313 extension build was stealing data from computers and giving hackers access via SSH.
The infected version was distributed through the Cursor extension marketplace for about 11 hours, and up to 5,000 users could have been affected. The official VS Code Marketplace and the Claude Code npm package were not affected.
If you installed Claude Code 2.1.313, here is a quick way to protect yourself:
• Disconnect your computer from the internet.
• Remove the Claude Code 2.1.313 extension.
• Block the address 134.209.82.225 on your router or via Windows Defender.
• Delete the unknown svc-telemetry key from ~/.ssh/authorized_keys.
• Check the SSH server with the command Get-Service sshd and stop it if it is running.
• Terminate the tunnel processes: Stop-Process -Id <PID> -Force.
• Delete the task: schtasks /delete /tn SysMon /f.
• Remove sysmon.cmd from startup.
• Change all important API keys, tokens, passwords, passphrases, etc.
Share with vibe coders.
