Malicious Claude Code extension planted SSH backdoors in Cursor

Cursor said in a security notice that a tampered build of Anthropic's Claude Code extension, version 2.1.313, sat in its extension marketplace for roughly 11 hours on October 29 and was delivered to as many as 5,000 developers with code intended to plant persistent SSH backdoors. The company said Anthropic did not develop the malicious extension.

Researchers at Phorion and OpenSourceMalware found that attackers inserted a small JavaScript loader at the start of the extension's extension.js file and left the rest of the legitimate code unchanged. StepSecurity independently verified that the loader runs as soon as Node.js loads the module, with no user interaction. The payload adds an attacker-controlled SSH key with the comment svc-telemetry to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, and installs persistence through a macOS LaunchAgent, a Windows scheduled task named SysMon or Startup folder script, and a cron reboot entry on Linux. It also collects the hostname, username, home directory, Git email, public IP address, and a list of up to 40 environment variable names that appear to be keys, tokens, passwords, or cloud credentials for AWS and GCP.

Phorion said coding errors in the malware's SSH setup likely prevented attackers from gaining remote access on many affected machines. On macOS the script runs systemsetup -getremotelogin without administrator rights and receives an error, so it skips enabling Remote Login. On Windows it tries to install OpenSSH Server through /bin/sh, a Unix shell not present on standard Windows systems, so setup fails. If SSH was already running, the backdoor could work. Phorion CEO Calum Hall said the payload's goal is "long-term interactive access" and stressed that it remains dangerous because it installs persistence and sends host reconnaissance to the operator.

Phorion spotted the malicious package on Open VSX, and StepSecurity said it independently confirmed that version 2.1.313 was served by Open-VSX and is now returned as not found. Cursor said its marketplace, which mirrors Open VSX, was the source of exposure for its users, and BleepingComputer later reported that initial reports of npm or Microsoft Visual Studio Marketplace impact were not confirmed. However, Manifold Security's Ax Sharma disputed reports that the Open VSX version was compromised, according to Help Net Security. The Microsoft Marketplace did not serve the malicious version, and StepSecurity found its download endpoint answers 404 for 2.1.313 but serves the clean versions on either side.

Cursor removed the malicious version and took its entire marketplace offline to review other extensions and rotate every access key. It said an internal investigation found no sign that any other version or the official distribution was affected, and it worked with the hosting company to take the server offline. StepSecurity recorded the exposure window as October 29, 09:27 UTC to 20:35 UTC, and Cursor said removal happened at 20:35 UTC. Cursor and StepSecurity advise checking authorized_keys for the svc-telemetry key, removing persistence artifacts such as com.apple.sysmond.plist, the SysMon scheduled task, cron @reboot entries, and .smt, .smtk, smt.cmd and .stk_* files, then rotating credentials reachable from affected machines. Uninstalling the extension alone is not enough because the loader drops standalone persistence.

Defenders should scan for version 2.1.313, check for the svc-telemetry SSH key and the indicators listed by Cursor and StepSecurity, and rebuild affected hosts if the reverse tunnel is confirmed to have connected.

Update, October 30, 2026

Anthropic has denied that its own systems or employee laptops were compromised in the Claude Code extension incident. Felix Rieseberg, a member of Anthropic's technical staff, wrote on X: "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops." He said someone with access to Cursor's marketplace placed an altered copy of the Claude Code extension, which Anthropic neither built nor published. Rieseberg added that versions on Anthropic's official channels were unaffected and only Cursor users were impacted.