Claude Code extension version 2.1.313 in the Cursor Marketplace was trojanized, installing an SSH backdoor

On October 29, 2026, a malicious version 2.1.313 of the Claude Code extension appeared in the Cursor Marketplace, whose main JS package inserted a 66-line malicious loader before legitimate code, installing a persistent SSH backdoor on users' machines. Cursor told OpenSourceMalware that the extension suffered some form of compromise that day and that the malicious version originated from this rather than Open-VSX, and Cursor has issued a notice about the incident; the @anthropic-ai/claude-code NPM package, the OpenVSX version, and the Microsoft VSCode version of the Claude extension do not contain malicious code. The article provides IOCs such as file hashes, SSH key fingerprints, and C2 addresses as well as troubleshooting and remediation recommendations, and states that the analysis only proves the sample is malicious and does not confirm that Anthropic's official release or distribution infrastructure was compromised.