Malicious Claude Code extension on Cursor planted SSH backdoors

What it is

A tampered build of Anthropic's Claude Code extension, version 2.1.313, was available in Cursor's VS Code extension marketplace from 2:27 a.m. to 1:35 p.m. Pacific Time on 29 October 2026. Up to 5,000 developers were exposed. Cursor says Anthropic did not build it. Phorion and OpenSourceMalware found that the attackers prepended a JavaScript loader to extension.js and left the legitimate code unchanged.

How it works

The loader runs when the extension loads, with no need to use Claude Code. It collects the Git email and public IP, adds an attacker SSH key, tries to enable SSH and open a reverse tunnel, and installs persistence. Persistence is a macOS LaunchAgent or a Windows scheduled task or Startup script, and the tunnel is retried about every minute. Host details and backdoor status go to 134.209.82[.]225.

Phorion says two bugs likely blocked remote access on many hosts:

• macOS: the script runs systemsetup -getremotelogin without elevated privileges. The command returns an administrator-access error instead of the service status. The script only enables SSH when the output contains "Off", so it skips that step.
• Windows: it tries to install and start OpenSSH Server through PowerShell, but launches it via /bin/sh, which standard Windows lacks. The setup fails.

In both cases the key, persistence and tunnel attempts still happen. The tunnel gives access only if an SSH server was already running.

Preconditions / Affected

• Anyone who installed or updated to Claude Code 2.1.313 from Cursor's marketplace during the window.
• The page says Cursor was the only source. Early reports of npm, Open VSX and the Visual Studio Code Marketplace being affected were later ruled out.
• Hosts already running an SSH server face real remote access. Others still leak reconnaissance data.

What to do

• Check each machine that installed the extension in the window for an svc-telemetry SSH key.
• If impact is confirmed, follow Cursor's remediation instructions. The page does not reproduce them.
• For affected machines, the page recommends isolating them, rotating accessible secrets, invalidating sessions, and rebuilding from safe backups.
• Treat the reconnaissance leak as exposed even if SSH failed. It included username, hostname, public IP, Git email, and the names of environment variables tied to sensitive credentials. The script does not steal credential values directly. The page infers the attackers planned to collect them by hand over the tunnel.

Caveats

• Cursor removed the extension, took its whole marketplace offline to audit extensions and rotate all access keys, and had the hosting provider take the attacker's server offline. That cuts both the tunnels and the data reporting.
• Cursor found no evidence that other extension versions or the official distribution were affected.
• It is unexplained how the attackers published under Anthropic's name, and whether Cursor's or Anthropic's systems were compromised. BleepingComputer had asked both companies and had no response yet.
• The failed SSH setup is Phorion's assessment ("likely"), not a confirmed outcome on every host.