Anthropic Claude Code extension tampered with in the Cursor marketplace, implanted with an SSH backdoor

The Cursor extension marketplace distributed a backdoored Anthropic Claude Code extension on October 29, 2026; versions 2.1.312 and 2.1.313 were distributed within a window of about 11 hours, and Cursor estimates that up to 5000 Windows and macOS users may be affected. The malicious code collects machine names, usernames, Git emails, public IPs and the names of up to 40 environment variables, adds an attacker-controlled SSH key to authorized_keys, attempts to establish a reverse SSH tunnel to 134.209.82.225, and achieves persistence via scheduled tasks, cron and macOS LaunchAgent. According to Panorays' analysis, the backdoor loader totals 66 lines and is located before the legitimate functional code, so the extension can still provide normal functionality.