Tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor

What happened

On 29 October, Cursor's extension marketplace offered a version 2.1.313 of the Claude Code extension, anthropic.claude-code, that had a malicious loader added to it. Cursor's own notice also lists a malicious 2.1.312 build for Windows and macOS served from its marketplace in the same period. Cursor reports that no more than 5,000 of its users received the tampered build, over a window of roughly 11 hours.

According to StepSecurity, simply loading the extension planted an attacker's SSH key, set up persistence, opened a reverse SSH tunnel to the attacker's server and reported details about the machine over plain HTTP. No Claude conversation was required to trigger it.

Anthropic says its systems and staff laptops were not compromised, and that it neither built nor published the tampered copy. StepSecurity reports that someone used access to Cursor's marketplace to publish the tampered copy, and that only Cursor users are affected. Microsoft says the malicious packages were never published or distributed through the Visual Studio Marketplace, and that all evidence points to Cursor's marketplace alone.

Cursor says it pulled the extension, took its whole marketplace offline and rotated keys, and that the attacker's server was taken down with help from its host. Later audits found no other tampered extensions, and Cursor is contacting affected users directly.

Background

The Claude Code extension is Anthropic's official editor integration and has tens of millions of lifetime downloads on Open-VSX alone. The tampered copy carried the genuine extension identifier rather than a lookalike name.

Early reports pointed at Open VSX, but OpenSourceMalware has since revised its article and no longer names Open VSX as the channel. Socket says its systems never ingested a 2.1.313 from npm, Open VSX or the VS Code Marketplace, and Anthropic confirmed it skipped straight to 2.1.314. The 2.1.312 build on Open-VSX is a different file, which StepSecurity checked and found clean.

How it works

Researchers at Phorion and OpenSourceMalware found the attackers put a JavaScript loader at the top of the extension's extension.js file. The modified file is about 7 KB bigger than the clean release before it. Microsoft says the loader hides command output and swallows errors while the extension keeps working as normal.

The loader gathers the hostname, username, operating system, architecture, home and working directories and the global Git email. It also records up to forty environment-variable names that contain words such as KEY, TOKEN, SECRET, PASS, AWS or GCP, but Microsoft says it sends the names, not the values.

If authorized_keys has no svc-telemetry entry, the loader adds an embedded Ed25519 public key to it. It then opens a reverse SSH tunnel, preferring autossh on Unix-like systems and a hidden PowerShell loop on Windows, retrying sixty seconds after each exit. Microsoft says that on macOS it persists through a user LaunchAgent called com.apple.sysmond, a name that resembles a monitoring component.

BleepingComputer reports that, according to Phorion, coding mistakes in the SSH setup probably stopped remote access on many Windows and macOS machines. On macOS the Remote Login check runs without elevated rights, so the malware never switches SSH on. Even so, Microsoft says keys and persistence can still be written when the tunnel fails.

Timeline

1. 29 Oct 2026
   09:27 UTC

   The tampered 2.1.313 is live in Cursor's marketplace.[1]

2. 29 Oct 2026, 20:35 UTC

   Cursor removes the version and takes its marketplace offline.[1]

3. 30 Oct 2026
   01:07 UTC

   A clean 2.1.314 is published to Open-VSX.[1]

Who is affected

• Cursor users who installed version 2.1.312 or 2.1.313 of the Claude Code extension from Cursor's marketplace during the window.
• Copies installed from Anthropic's official channels are not affected.

Impact

Cursor puts the number of users who received the build at 5,000 or fewer. Cursor reports that errors and the need for administrator rights blocked SSH access on most macOS and Windows hosts. Where the tunnel did work, the planted key gave interactive SSH access to the machine.

BleepingComputer notes the script does not steal credentials directly, which suggests the attackers planned to collect data by hand over the tunnel. Microsoft says its analysis does not attribute the activity to any particular threat actor.

How to check

1. Find out whether any developer added or updated the extension from Cursor's marketplace while the bad build was live.
2. Search ~/.ssh/authorized_keys for a key labelled svc-telemetry. Compare it with the published fingerprint before removing that exact entry.
3. Search installed extension bundles for extension.js files that contain 134.209.82.225 or svc-telemetry.

What to do

1. Keep a copy of the extension package, the SSH key files, scripts and startup settings before you clean up.
2. On macOS, unload and delete the LaunchAgent com.apple.sysmond.plist and remove ~/.config/.smt and ~/.config/.smtk. Cursor provides remediate-macos.sh and remediate-windows.ps1 scripts for this.
3. Stop any malicious SSH or retry processes and delete the temporary .stk_ key files.
4. Remove the affected version and install 2.1.314 or later. Uninstalling the extension alone leaves the persistence behind.
5. From a known-clean machine, rotate the source-control and CI/CD tokens that the affected machine could reach.
6. If the tunnel is confirmed to have connected, rebuild the machine rather than cleaning it.
7. In Cursor, limit extensions to approved publishers and set an installation cooldown for newly published versions.