Claude Code extension versions 2.1.312 and 2.1.313 on Cursor were tampered with and attempted to install a backdoor
Compromised Claude Code extensions (versions 2.1.312 & 2.1.313) in Cursor try to install a backdoor
On October 29, 2026, tampered versions 2.1.312 and 2.1.313 of the Claude Code extension appeared in Cursor's VS Code extension marketplace, which attempt to install a persistent SSH backdoor on developers' machines. The tampered versions were listed in the marketplace between approximately 2:27 AM and 1:35 PM Pacific Time, covering Windows and macOS builds, and were not developed by Anthropic. The malicious code collects host and user information, adds an attacker-controlled SSH public key (labeled svc-telemetry) to authorized_keys, attempts to enable the local SSH service and establish a reverse tunnel to 134.209.82.225, installs persistence mechanisms such as a macOS LaunchAgent and a Windows scheduled task SysMon, and a background script retries the connection approximately every 60 seconds.
The article outlines the attack chain and provides detection commands, noting that merely uninstalling the extension may not remove the persistent backdoor; developers who installed an affected version can use this to investigate.