Claude Code Extension Poisoned, Implanted with a Persistent SSH Backdoor

Security firm Phorion says it found a tampered Anthropic Claude Code extension version 2.1.313 in the open-source extension marketplace Open VSX; this version implants an SSH backdoor on developers' machines. Cursor says the malicious version was listed on its extension marketplace for about 11 hours on October 29, 2026, affecting at most 5,000 users, and was not developed by Anthropic. The malicious code executes as soon as the extension loads, writes the attacker's SSH key into authorized_keys and establishes an outbound tunnel, sets up persistence on three platforms, and also exfiltrates the hostname, Git email, public IP and the names of up to 40 environment variables suspected to be credentials. Cursor says that on most Mac and Windows hosts the attacker could not log in through the tunnel, and that it has taken the attacker's server offline and rebuilt the extension marketplace.