A malicious Claude Code extension was distributed through Cursor’s VS Code Extension Marketplace on 29 October 2026. The tampered package attempted to establish persistent SSH access on developer computers while continuing to look like a legitimate Anthropic extension.
The incident was limited to two extension versions available for approximately 11 hours. Cursor estimated that no more than 5,000 users were exposed, but affected systems require targeted checks because uninstalling the extension may not remove the SSH key or persistence mechanisms.
How the malicious Claude Code extension was distributed
The threat actor uploaded altered builds of the legitimate package, identified as anthropic.claude-code, to Cursor’s marketplace. Versions 2.1.312 and 2.1.313 were available from approximately 09:27 to 20:35 UTC on 29 October 2026.
Because the packages retained the legitimate extension identity, they could appear to users as authentic updates rather than an unrelated imitation. This made the incident a software supply chain attack involving a trusted distribution channel and an established developer tool.
Cursor removed the packages, temporarily shut down its marketplace and worked with the relevant hosting provider to take the attacker’s server offline. A clean build, version 2.1.314, was subsequently reported as the replacement.
The confirmed exposure was confined to Cursor’s VS Code Extension Marketplace. Microsoft and Anthropic said the malicious builds were not distributed through Microsoft’s Visual Studio Marketplace, npm or Anthropic’s own systems. Anthropic also said its infrastructure had not been breached.
Several early reports associated the incident with Open VSX. Later findings from Microsoft, Anthropic and independent researchers corrected that account, stating that the trojanised Claude Code extension was served only through Cursor’s marketplace.
Confirmed products, versions and platforms
- Affected package: anthropic.claude-code.
- Affected versions: 2.1.312 and 2.1.313.
- Distribution channel: Cursor’s VS Code Extension Marketplace.
- Confirmed platform scope: Cursor users on macOS and Windows.
- Reported clean replacement: version 2.1.314.
- Not affected: Microsoft’s Visual Studio Marketplace and npm package @anthropic-ai/claude-code.
Third-party analysis identified Linux-related persistence logic within the malicious code. However, Cursor’s confirmed exposure scope covered macOS and Windows, so organisations should distinguish between capabilities found in the package and platforms confirmed as affected.
Inside the Claude Code extension SSH backdoor
The malicious package placed a small JavaScript loader before the legitimate extension bundle. Researchers described it as a 66-line loader that ran when the module loaded, before the expected Claude Code extension code.
The loader did not need to depend on VS Code application programming interfaces. This allowed the malicious activity to begin as part of ordinary module loading, reducing the need for additional interaction after installation or update.
Host reconnaissance and beaconing
The code gathered information about the infected computer and attempted to send it to attacker-controlled infrastructure. Collected details included the hostname, username, operating system, processor architecture, home directory, working directories, configured Git email and public IP address.
It also collected the names of environment variables. Although this does not necessarily mean their values were stolen, the names can reveal information about development tools, cloud platforms and other services configured on a workstation.
The loader communicated with 134.209.82.225 and used an HTTP beacon at http://134.209.82.225:8099/beacon. Cursor later reported that the attacker server had been taken offline.
SSH access and reverse tunnelling
The malicious Claude Code extension attempted to write an attacker-controlled public key into the user’s ~/.ssh/authorized_keys file. The inserted key carried the label svc-telemetry, a name designed to resemble a routine service account or monitoring component.
It then attempted to enable the computer’s local SSH service and create reverse SSH forwarding to attacker infrastructure. A reverse tunnel can provide an operator with a route back into a system even when that machine is behind network address translation or does not accept direct inbound internet connections.
Successful remote access was not guaranteed. It depended on the user’s privileges, local SSH configuration, operating system controls and the availability and configuration of the attacker’s server.
Cursor noted that errors in the malicious code and the absence of elevated rights meant SSH service enablement would often fail on typical macOS and Windows systems. Even where the complete backdoor failed, the authorised key, startup components or other artefacts could remain.
Persistence after the extension was removed
On macOS, the loader attempted to create a LaunchAgent. On Windows, it used a Scheduled Task, with a Startup script as a fallback. Background scripts were designed to retry at intervals of roughly 60 seconds.
This persistence is important because deleting the Claude Code extension does not necessarily reverse changes already made outside its installation directory. An SSH key or startup task may continue to exist after the original package has disappeared.
Incident timeline and current exploitation status
- 29 October 2026: Versions 2.1.312 and 2.1.313 were available in Cursor’s marketplace between approximately 09:27 and 20:35 UTC. Cursor removed them and issued a security notice.
- 30 October 2026: Microsoft Security Research published its technical analysis. Independent researchers released static analysis, hashes and infrastructure indicators, and clean version 2.1.314 was reported as available.
- 2 November 2026: ThreatDefence updated its advisory with the clarified exposure window, additional hashes and hunting guidance.
This was active malicious distribution rather than a theoretical vulnerability or proof of concept. Trojanised packages reached the marketplace and were available to real users, with Cursor estimating exposure of up to 5,000 people.
No threat actor has been publicly attributed. The command and control server is reportedly offline, but this does not prove that every affected endpoint has been cleaned or that information collected during the exposure window has been deleted.
How organisations should respond
Organisations using Cursor should identify whether versions 2.1.312 or 2.1.313 were installed during the confirmed window. Updating to version 2.1.314 or later is necessary, but it should be followed by checks for changes made by the malicious Claude Code extension.
- Search ~/.ssh/authorized_keys for an unexpected key labelled svc-telemetry.
- Review macOS LaunchAgents and Windows Scheduled Tasks or Startup scripts for unfamiliar persistence.
- Hunt for connections to 134.209.82.225, particularly port 8099 and unexpected SSH tunnelling.
- Check for SHA256 hashes ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 and 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278.
- Use Cursor’s remediation scripts and endpoint detection records to establish whether the loader executed.
Developer workstations often hold source code, credentials and access to production services. For affected organisations, the priority is therefore to verify execution, remove persistent artefacts and investigate any related access, rather than assuming that uninstalling the package completed remediation.
Originally reported by microsoft.com.
