Cursor discloses malicious Claude Code extension attempting to install SSH backdoor

Cursor disclosed on October 29 that a maliciously modified version Anthropic.claude-code 2.1.313 appeared in its VS Code extension marketplace; the package was not developed by Anthropic, collects host information and attempts to install a persistent SSH backdoor, with up to 5000 users affected. The malicious version was listed from approximately 2:27 to 13:35 (Pacific Time) on October 29 and attempts to add an attacker-controlled SSH key to authorized_keys and establish a reverse tunnel; Cursor said that due to an error in the malicious code, this step fails except in rare cases such as running with administrator privileges, but the extension still installs a persistence mechanism and sends host information back. Cursor has taken down the malicious version, shut down and rebuilt the marketplace, worked with the cloud service provider to take the attacker's server 134.209.82.225 offline, and said there is no evidence that other versions or official distribution were affected.