{"title":"Claude Code incident: a negative SSH-key check does not rule out past payload execution","description":"The sampled checks answer different questions. A missing key-comment match, zero hunting results and successful artifact cleanup are not interchangeable evidence that a host was never compromised.","dataset_id":"spd:claude-code-extension-incident-what-does-a-negative-ssh-key-check-rule-out-163be410","canonical_url":"https://superpowerdaily.com/research/claude-code-extension-incident-what-does-a-negative-ssh-key-check-rule-out-163be410","version_url":"https://superpowerdaily.com/research/claude-code-extension-incident-what-does-a-negative-ssh-key-check-rule-out-163be410","version":"Live","snapshot_hash":null,"date_created":null,"date_modified":"2026-10-30T15:42:37.129Z","license":{"name":"Superpower Daily data reuse terms","url":"https://superpowerdaily.com/terms"},"license_url":"https://superpowerdaily.com/terms","coverage_note":"The sample is limited to four supplied documents, not all incident guidance or affected hosts. The requested evidence cutoff remains October 30, 2026, 15:31 UTC. Snapshots were retrieved at 15:32:11.074 UTC, after that cutoff; exact cutoff versions are therefore unverified, and Beaumont’s query references mutable master. Cursor’s page is dated October 29, not October 30. Reusing the saved evidence is not a new collection or experiment.","measurement_technique":["Statically compare the supplied snapshots of Cursor’s incident notice, Phorion’s technical advisory, StepSecurity’s analysis and Kevin Beaumont’s public KQL. No payload, quick check, remediation script or hunting query was executed.","Plan an evidence_matrix with rows for each check and columns for source, platform and user scope, required evidence or telemetry, supported positive interpretation, supported negative interpretation and unresolved conditions. Do not assign detection-effectiveness scores.","Package exposure row: distinguish a matching malicious package hash from a version-string lead. Possession identifies the artifact; installation establishes exposure. Phorion and StepSecurity identify extension.js loading as the execution trigger, which installation alone does not establish.","SSH-key row: record that Cursor’s macOS check covers the current user’s authorized_keys, while Windows also checks administrators_authorized_keys. A negative result means no successful comment match in those paths. The macOS command also routes a grep error into the negative message. Phorion recommends fingerprint verification; a verified attacker key establishes an unauthorized authentication artifact, not a successful login.","Persistence row: distinguish a filename lead from verified malicious script content and registration through a macOS LaunchAgent, Windows SysMon task or Startup fallback, or Linux reboot cron entry. Installed persistence does not establish successful execution after reboot.","Network and access row: Beaumont’s attacker-IP query identifies recorded network events without filtering connection outcome. A verified tunnel still does not establish operator login. Phorion identifies successful localhost-origin SSH authentication using the planted key as follow-on access evidence.","Hunting row: document dependencies on DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents and DeviceRegistryEvents. Separate broad version-string selectors from corroborated package evidence, and record the SSH query’s immediate-IDE-parent restriction. Zero results establish only no matching records in the queried telemetry.","Remediation row: separate Cursor’s stated remaining-artifact exit-status contract from historical compromise assessment. Attribute StepSecurity’s rebuild recommendation after a connected tunnel as precautionary guidance, not proof of authentication."],"methodology":["Statically compare the supplied snapshots of Cursor’s incident notice, Phorion’s technical advisory, StepSecurity’s analysis and Kevin Beaumont’s public KQL. No payload, quick check, remediation script or hunting query was executed.","Plan an evidence_matrix with rows for each check and columns for source, platform and user scope, required evidence or telemetry, supported positive interpretation, supported negative interpretation and unresolved conditions. Do not assign detection-effectiveness scores.","Package exposure row: distinguish a matching malicious package hash from a version-string lead. Possession identifies the artifact; installation establishes exposure. Phorion and StepSecurity identify extension.js loading as the execution trigger, which installation alone does not establish.","SSH-key row: record that Cursor’s macOS check covers the current user’s authorized_keys, while Windows also checks administrators_authorized_keys. A negative result means no successful comment match in those paths. The macOS command also routes a grep error into the negative message. Phorion recommends fingerprint verification; a verified attacker key establishes an unauthorized authentication artifact, not a successful login.","Persistence row: distinguish a filename lead from verified malicious script content and registration through a macOS LaunchAgent, Windows SysMon task or Startup fallback, or Linux reboot cron entry. Installed persistence does not establish successful execution after reboot.","Network and access row: Beaumont’s attacker-IP query identifies recorded network events without filtering connection outcome. A verified tunnel still does not establish operator login. Phorion identifies successful localhost-origin SSH authentication using the planted key as follow-on access evidence.","Hunting row: document dependencies on DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents and DeviceRegistryEvents. Separate broad version-string selectors from corroborated package evidence, and record the SSH query’s immediate-IDE-parent restriction. Zero results establish only no matching records in the queried telemetry.","Remediation row: separate Cursor’s stated remaining-artifact exit-status contract from historical compromise assessment. Attribute StepSecurity’s rebuild recommendation after a connected tunnel as precautionary guidance, not proof of authentication."],"metrics":[{"label":"Verified observations","value":"0","detail":"0 measured fields"},{"label":"Supported claims","value":"10","detail":"10 material findings"},{"label":"Cited sources","value":"4","detail":"4 primary or authoritative"},{"label":"Research score","value":"81","detail":"Automated topic and evidence score"}],"columns":[{"key":"entity","label":"Entity"},{"key":"metric","label":"Metric"},{"key":"value","label":"Value"},{"key":"unit","label":"Unit"},{"key":"observed","label":"Observed"},{"key":"source","label":"Source"},{"key":"transform","label":"Transform"}],"data":[],"sources":[{"name":"Phorion","title":"Official Claude Code Extension Compromise: Security Advisory | Phorion","url":"https://phorion.io/blog/offical-claude-code-vsx-compromise","records":0},{"name":"Cursor","title":"Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace · Cursor","url":"https://cursor.com/blog/claude-code-extension-security-notice","records":0},{"name":"Kevin Beaumont / GossiTheDog","title":"ThreatHunting/AdvancedHuntingQueries/AnthropicSupplyChainAttack.kql at master · GossiTheDog/ThreatHunting","url":"https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/AnthropicSupplyChainAttack.kql","records":0},{"name":"StepSecurity","title":"Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines - StepSecurity","url":"https://www.stepsecurity.io/blog/claude-code-extension-trojanized","records":0}],"provenance":{"publisher":"Superpower Daily","source_count":4,"source_urls":["https://phorion.io/blog/offical-claude-code-vsx-compromise","https://cursor.com/blog/claude-code-extension-security-notice","https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/AnthropicSupplyChainAttack.kql","https://www.stepsecurity.io/blog/claude-code-extension-trojanized"],"methodology":["Statically compare the supplied snapshots of Cursor’s incident notice, Phorion’s technical advisory, StepSecurity’s analysis and Kevin Beaumont’s public KQL. No payload, quick check, remediation script or hunting query was executed.","Plan an evidence_matrix with rows for each check and columns for source, platform and user scope, required evidence or telemetry, supported positive interpretation, supported negative interpretation and unresolved conditions. Do not assign detection-effectiveness scores.","Package exposure row: distinguish a matching malicious package hash from a version-string lead. Possession identifies the artifact; installation establishes exposure. Phorion and StepSecurity identify extension.js loading as the execution trigger, which installation alone does not establish.","SSH-key row: record that Cursor’s macOS check covers the current user’s authorized_keys, while Windows also checks administrators_authorized_keys. A negative result means no successful comment match in those paths. The macOS command also routes a grep error into the negative message. Phorion recommends fingerprint verification; a verified attacker key establishes an unauthorized authentication artifact, not a successful login.","Persistence row: distinguish a filename lead from verified malicious script content and registration through a macOS LaunchAgent, Windows SysMon task or Startup fallback, or Linux reboot cron entry. Installed persistence does not establish successful execution after reboot.","Network and access row: Beaumont’s attacker-IP query identifies recorded network events without filtering connection outcome. A verified tunnel still does not establish operator login. Phorion identifies successful localhost-origin SSH authentication using the planted key as follow-on access evidence.","Hunting row: document dependencies on DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents and DeviceRegistryEvents. Separate broad version-string selectors from corroborated package evidence, and record the SSH query’s immediate-IDE-parent restriction. Zero results establish only no matching records in the queried telemetry.","Remediation row: separate Cursor’s stated remaining-artifact exit-status contract from historical compromise assessment. Attribute StepSecurity’s rebuild recommendation after a connected tunnel as precautionary guidance, not proof of authentication."],"snapshot_hash":null},"distributions":{"csv":"https://superpowerdaily.com/api/research/claude-code-extension-incident-what-does-a-negative-ssh-key-check-rule-out-163be410?format=csv","json":"https://superpowerdaily.com/api/research/claude-code-extension-incident-what-does-a-negative-ssh-key-check-rule-out-163be410?format=json"}}