Skip to content
AI Security Wire

Published

- 4 min read

By

Trojanized Claude Code Extension Hit Cursor Marketplace for 11 Hours

Cursor Claude Code VS Code extension supply chain SSH backdoor marketplace security
img of Trojanized Claude Code Extension Hit Cursor Marketplace for 11 Hours

On October 29, 2026, a maliciously modified version of Anthropic’s Claude Code extension was available in Cursor’s extension marketplace for about 11 hours. Cursor says Anthropic did not develop it. The code planted an attacker SSH key and tried to open a reverse tunnel to an attacker server. Cursor and Phorion say that on many machines the backdoor would not have worked as intended; OpenSourceMalware stresses that the key and persistence were installed regardless.

What happened

Cursor’s security notice puts the availability window at roughly 2:27 a.m. to 1:35 p.m. Pacific time on October 29. Cursor removed the malicious version, blocked further distribution and temporarily shut down the marketplace while it audited other extensions and rotated keys. It says it worked with the hosting provider to take the attacker’s server offline, and that “the attacker server no longer functions.” BleepingComputer, which reported up to 5,000 developers potentially exposed, is the only source we read that gives that figure, and we could not see a basis for it. Neither Cursor’s notice nor the two research write-ups give an install count.

Cursor’s October 30 update names versions 2.1.312 and 2.1.313 of Anthropic.claude-code for Windows and macOS. Earlier reporting named only 2.1.313.

How the loader worked

According to Phorion and OpenSourceMalware, an injected loader was prepended to the extension’s minified extension.js, while the rest of the extension was left intact. It runs when the extension loads, with no user interaction.

The loader:

  • appends an Ed25519 key commented svc-telemetry to ~/.ssh/authorized_keys;
  • tries to enable the local SSH service;
  • opens a reverse SSH tunnel to 134[.]209[.]82[.]225, retrying about every 60 seconds;
  • sets up persistence (a macOS LaunchAgent named com.apple.sysmond.plist, a Windows scheduled task named SysMon, or a Linux cron entry);
  • sends a beacon with hostname, username, OS, Git email, public IP and the names, not values, of up to 40 environment variables matching patterns such as KEY, TOKEN or AWS.

OpenSourceMalware found no additional download stage. It does not claim attribution, and it says the attacker’s identity and infrastructure ownership are unverified.

Why it often failed

Phorion’s analysis, which is a vendor write-up we have not independently reproduced, says the macOS path runs systemsetup -getremotelogin without root and then skips the enablement step, so the tunnel connects but nothing listens on port 22 unless Remote Login was already on. On Windows, it says a helper appears to hardcode /bin/sh, so the OpenSSH setup would likely not get far on a standard install. Cursor says the SSH step would likely fail on most hosts without admin rights.

That is only partial comfort. The key and persistence are still written to disk, and Phorion says the backdoor was “ready and waiting” if SSH was enabled later. That applied while the attacker’s server was up; Cursor says it is now offline, but the artefacts remain until removed, which is why Cursor says to remediate regardless. The beacon is sent regardless, and Cursor notes that the limited environment-variable collection “does not rule out later credential access over the backdoor.”

What to do

Cursor and the researchers recommend the same core steps:

  1. Search for the svc-telemetry key in authorized_keys and for the persistence files and scheduled task above.
  2. Look for outbound connections to 134[.]209[.]82[.]225 on TCP 22 and 8099, and for ssh or autossh running with -R *:0:localhost:22.
  3. Isolate affected hosts, remove the key, persistence and tunnel processes, and consider a rebuild.
  4. Rotate credentials and sessions reachable from the host, from a clean system.

Cursor publishes SHA-256 hashes, key fingerprints and remediation scripts in its notice.

Why it matters

Extensions run with the developer’s own privileges, inside editors. A trojanized copy of a widely trusted AI coding extension is a supply-chain risk in itself. The open question, which none of the three sources answers, is how the attacker published under Anthropic’s name on Cursor’s marketplace and whether Cursor’s or Anthropic’s systems were compromised. Our assessment: treat any marketplace extension update that arrives with no matching upstream release as suspect until the publisher confirms it.

No evidence of an Anthropic statement was found as of October 31, 2026 in the Cursor notice, the Phorion and OpenSourceMalware write-ups, or BleepingComputer’s article.

References

Frequently Asked Questions

Which versions and platforms were affected?
Cursor's notice names Anthropic.claude-code versions 2.1.312 and 2.1.313 on Windows and macOS, distributed through the Cursor marketplace. BleepingComputer, Phorion's first advisory and OpenSourceMalware named only 2.1.313. Cursor's IOC list also includes Linux persistence paths, which its scope statement does not mention.
Was the Open VSX, npm or Microsoft VS Code copy of the extension affected?
OpenSourceMalware says the npm package, the Open VSX extension and the Microsoft VS Code extension were not affected, and that Cursor told it the compromise came from the Cursor marketplace copy. Cursor says it has no evidence that other versions or the official distribution are affected. How the modified copy was published under Anthropic's name has not been explained in the sources we read.
What should I do if I installed it?
Cursor says to check for the svc-telemetry SSH key, isolate hosts showing the payload, remove the key, persistence and tunnel processes, and rotate credentials reachable from the host. It warns that uninstalling the extension may not be sufficient and provides remediation scripts for macOS and Windows.