Malicious Claude Code extension breaches the Cursor marketplace
Start here
On October 29, 2026, a malicious Claude Code extension anthropic.claude-code 2.1.313, which was not developed by Anthropic (some reports say 2.1.312 was also involved), appeared in the Cursor extension marketplace and was listed for about 11 hours; Cursor estimates that at most 5,000 users installed it, after which it was removed and the marketplace was briefly closed. The extension preloads a loader in extension.js that, upon loading, collects the hostname, username, Git email, public IP and the names of up to 40 environment variables suspected to be credentials, adds an attacker-controlled SSH key to authorized_keys, attempts to establish a reverse tunnel to 134.209.82[.]225, and installs persistence. Cursor stated that, because administrator privileges are required, the backdoor may fail on most machines, and that there is no evidence that other extensions or official distribution channels were affected. Phorion first discovered the extension on a customer's Mac; regarding the source of the malicious version, some reports say it entered Cursor via synchronization from the Open VSX mirror, while others say the attacker took control of Anthropic's official distribution account on Cursor, and Socket's review overturned its initial claim pointing to the Open VSX channel. Researchers remind that deleting the extension does not remove the threat, and residual items such as SSH authorizations need to be checked.
Generated by AI from reports · Updated 3 hr ago
Progress timeline
- RedditReddit r/cybersecurity· DiscussionThe Cursor’s Claude Code Incident(opens the original post in a new tab)
- WebGigazine· Media coverageSSH backdoor found in “Claude Code” in Cursor's official marketplace(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageMalicious Claude Code Extension Served in Cursor Supply Chain Attack(opens the original post in a new tab)
- E-WorksHow does the malicious Claude Code extension endanger the security of up to 5,000 developers?
Security firm Phorion disclosed that a malicious Claude Code extension implanted with an SSH backdoor was uploaded to the Open VSX platform on October 29, with version number 2.1.313, taken down after 11 hours online, affecting at most 5,000 developers. The backdoor allowed attackers to access developers' machines, obtain Git emails and up to 40 environment variables, and thereby target cloud credentials or API tokens. Phorion noted that deleting the extension does not remove the threat; the malicious payload leaves behind autonomously running scripts, and developers need to check SSH authorization files for suspicious entries such as svc-telemetry; because of an error in the administrator privilege check, the impact on macOS is limited, but users of other operating systems still face the threat. Cursor has closed its extension marketplace for an in-depth security audit and provided a cleanup script; Anthropic has not yet alerted customers, but says the tampered version was not released by it.
- WebAI Threat Watch (aithreat.io)· Media coverageMalicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS(opens the original post in a new tab)
- WebBoannews (Korea)· Media coverage커서 마켓에 변조된 ‘클로드 코드’ 올라와... 최대 5000명 설치(opens the original post in a new tab)
- Developpez.comSelectedMalicious version of the Anthropic Claude Code extension implants an SSH backdoor, affecting the computers of up to 5000 developers
Security firm Phorion discovered that a tampered version 2.1.313 of the Anthropic Claude Code extension was distributed on Open VSX and implanted an SSH backdoor; Cursor estimates that up to 5000 users may be affected. This version was listed on the Cursor extension marketplace on October 29 for about 11 hours, executed malicious code on load without user interaction, added the attacker's SSH key to the authorized list and established an outbound tunnel, returning the hostname, Git email and the names of up to 40 environment variables suspected to be credentials; uninstalling the extension also could not remove the backdoor. Phorion pointed out that the check in the script for activating SSH was flawed, and Cursor said that because activating SSH requires administrator privileges, the attacker could not log in through the tunnel on most Mac and Windows hosts.
- WeChatDoonsec· Media coverageClaude official extension poisoned to implant a persistent SSH backdoor(opens the original post in a new tab)
- Developpez.comSelectedClaude Code extension version 2.1.313 implanted with an SSH backdoor; Cursor estimates up to 5,000 developers affected
Security firm Phorion found that the Claude Code extension for VS Code-compatible editors had been tampered with; version 2.1.313 appeared on Open VSX and was listed on the Cursor extension marketplace for about 11 hours, and Cursor estimates that up to 5,000 developers may be affected. The tampered version inserts an immediately invoked function expression at the start of extension.js, which writes the attacker's SSH key into the user's authorized_keys as soon as Node loads the file, and actively connects to the attacker's server to establish a tunnel, reconnecting about every 60 seconds; it also achieves persistence via a macOS launch item, Linux cron, and a scheduled task named SysMon on Windows. It sends back the hostname, username, working directory, Git email, public IP, and the names of up to 40 environment variables that appear to be keys or cloud credentials.
- RedditReddit r/cybersecurity· DiscussionInside a malicious Claude Code-branded extension and its persistent SSH backdoor | Microsoft Security Blog(opens the original post in a new tab)
- CSA Labs ResearchSelectedDistributed under the official Anthropic publisher identity: a trojanized Claude Code extension in the Cursor marketplace
On October 29, 2026, the Cursor extension marketplace distributed trojanized Claude Code extensions 2.1.312 and 2.1.313 (macOS and Windows versions) under the legitimate identifier anthropic.claude-code, and they were taken down after about 11 hours online. The payload runs as soon as the extension loads, planting an attacker SSH key labeled svc-telemetry, establishing a reverse SSH tunnel to 134.209.82[.]225, installing persistence, and exfiltrating host reconnaissance information over plaintext HTTP; uninstalling or updating the extension does not remove these traces. Cursor stated that these builds were not developed by Anthropic and initially said that at most 5000 users were affected; Anthropic stated that its systems were not compromised and that versions on official channels such as Open VSX were not affected.
- Brief IASelectedAnthropic Claude Code extension tampered with in the Cursor marketplace, implanted with an SSH backdoor
The Cursor extension marketplace distributed a backdoored Anthropic Claude Code extension on October 29, 2026; versions 2.1.312 and 2.1.313 were distributed within a window of about 11 hours, and Cursor estimates that up to 5000 Windows and macOS users may be affected. The malicious code collects machine names, usernames, Git emails, public IPs and the names of up to 40 environment variables, adds an attacker-controlled SSH key to authorized_keys, attempts to establish a reverse SSH tunnel to 134.209.82.225, and achieves persistence via scheduled tasks, cron and macOS LaunchAgent. According to Panorays' analysis, the backdoor loader totals 66 lines and is located before the legitimate functional code, so the extension can still provide normal functionality.
- CybersecuritynewsSelectedCursor confirms malicious Claude Code extension with SSH backdoor was listed for 11 hours
Cursor confirmed that a malicious Claude Code extension package with an SSH backdoor was listed on its VS Code Extension Marketplace for about 11 hours on October 29, 2026, with affected versions Anthropic.claude-code 2.1.312 and 2.1.313, targeting Windows and macOS users; Cursor stated that these malicious versions were not developed by Anthropic. The malicious code collected hostnames, usernames, operating systems, Git emails, public IPs and environment variable names, added an attacker SSH public key named svc-telemetry to authorized keys, and attempted to enable the local SSH service and establish a reverse tunnel; due to code errors and lack of administrator privileges, remote login attempts were limited on most hosts.
- Cyber PressSelectedMicrosoft warns that trojanized Claude Code extensions attempt to implant persistent SSH backdoors
Microsoft warns that trojanized Claude Code extensions distributed through the Cursor marketplace attempted to install persistent SSH backdoors on developer workstations, involving versions anthropic.claude-code 2.1.312 and 2.1.313. The malicious JavaScript executes before the extension's normal initialization, collects information such as hostname, username and global Git email, appends a built-in Ed25519 public key to authorized_keys and establishes a reverse SSH tunnel, persisting on macOS, Linux and Windows via a LaunchAgent, a crontab @reboot entry and a scheduled task respectively; the relevant files are located outside the extension directory, so uninstalling or updating the extension will not remove them.
- Ars Technica AISelectedAnthropic's VS Code extension was implanted with a backdoor on Cursor for nearly 12 hours
An Anthropic VS Code extension was implanted with a backdoor in the Cursor extension marketplace; the malicious version 2.1.313 was present for nearly 12 hours and affected up to 5,000 users. Luke Roberts, CTO and co-founder of security firm Phorion, called it a supply chain intrusion in which attackers took control of Anthropic's official distribution account on Cursor, publishing 2.1.313 and replacing 2.1.312. Independent researcher Kevin Beaumont said Anthropic pushed 2.1.314 several hours later. Cursor and Anthropic have not yet explained how attackers gained control of the account, and Anthropic has not yet warned customers about the matter.
- WIRED Security and AISupply chain attack installs malicious Anthropic Claude extension on thousands of devices
A malicious Anthropic Claude Code extension containing a backdoor was listed on Cursor's IDE extension marketplace for about 11 hours, and Cursor said at most 5,000 users downloaded it. The extension covered Windows, macOS and Linux and was designed to give attackers access to victims' devices; Cursor briefly shut down the extension marketplace and published remediation steps, saying other extensions were unaffected. Detection firm Phorion first found the extension on a customer's Mac, and its co-founder and CEO Calum Hall said design flaws in the malware itself prevented it from fully persisting on the vast majority of targets. Anthropic technical staff member Felix Rieseberg said this was not a compromise of Anthropic systems or employee computers, but rather someone using access to the Cursor marketplace to publish a tampered copy of the extension, and that the version on official channels was unaffected; how the malicious extension entered the marketplace remains unclear.
- Dark ReadingDevelopers affected by trojanized Claude Code extension on the Cursor platform
Anthropic's official Claude Code extension was hijacked on Cursor's VS Code Marketplace and replaced with a backdoored malicious version; according to Cursor's disclosure, the attack lasted 11 hours, during which developers who downloaded or updated the extension received the malicious version 2.1.313, with up to 5,000 users affected. According to OpenSourceMalware's analysis, the malicious code added only a 66-line loader to extension.js, attempting to add an attacker-controlled SSH key to establish a reverse tunnel and register a persistent process; Cursor said the backdoor was difficult to succeed because it required administrator privileges, but the malicious code exfiltrated system information such as hostname, Git email and public IP. Cursor said the malicious version was not developed by Anthropic, has rotated keys, temporarily took down and rebuilt the marketplace, and worked with cloud providers to shut down the attack infrastructure.
- The DecoderSelectedMalicious Claude Code extension appears in Cursor extension marketplace, attempting remote access and data theft
Cursor said a tampered malicious Claude Code extension appeared in its VS Code extension marketplace on Thursday, was listed for about 11 hours, and affected up to 5,000 users. The extension attempted to collect information such as hostname, username, operating system and public IP, and attempted to establish remote access for the attacker, but Cursor said this likely could not succeed on most machines because it requires administrator privileges. After discovery, Cursor removed the extension and took the entire marketplace offline, restoring it after working with service providers to remove the malware and confirming no further risk, and said other extensions were unaffected; Anthropic was not involved in developing the extension.
- Field EffectSelectedTrojanized Claude Code extension distributed through the Cursor marketplace
On October 29, 2026, a trojanized version 2.1.313 of a Claude Code extension was distributed through the Cursor extension marketplace; Cursor estimates that up to 5000 users installed it, has taken down the package, rotated keys, and said there is no evidence that other extensions or official distribution channels were affected. The malicious version injected 66 lines of loader code ahead of the legitimate code in extension.js; when the extension loaded, it automatically collected information such as hostname, username, Git configuration and public IP, added an attacker-controlled SSH key to authorized_keys, installed persistence mechanisms on macOS, Windows and Linux, and attempted to establish a reverse SSH tunnel. The incident did not exploit a Claude Code vulnerability; rather, a trojanized build was published under Anthropic's legitimate extension identifier. Anthropic released version 2.1.314 on October 30.
- MorphisecTrusted tool, malicious build: what a trojanized Claude Code extension means for developer terminals
On October 29, 2026, a malicious build of Claude Code extension version 2.1.313 was distributed via the Open VSX registry and the Cursor extension marketplace; within about 11 hours, users who installed or auto-updated the extension in Cursor may have been implanted with code enabling persistent remote access for attackers. Cursor confirmed the incident and said at most 5000 users were affected; the malicious version was not developed by Anthropic and was listed under a legitimate publisher identity. According to Cursor's notice, the build exfiltrates host and user information, writes an attacker public key labeled svc-telemetry into SSH authorized_keys, attempts to establish a reverse SSH tunnel, and installs a macOS LaunchAgent or Windows scheduled task to achieve persistence with retries about every 60 seconds.
- OX SecuritySelectedClaude Code extension versions 2.1.312 and 2.1.313 on Cursor were tampered with and attempted to install a backdoor
On October 29, 2026, tampered versions 2.1.312 and 2.1.313 of the Claude Code extension appeared in Cursor's VS Code extension marketplace, which attempt to install a persistent SSH backdoor on developers' machines. The tampered versions were listed in the marketplace between approximately 2:27 AM and 1:35 PM Pacific Time, covering Windows and macOS builds, and were not developed by Anthropic. The malicious code collects host and user information, adds an attacker-controlled SSH public key (labeled svc-telemetry) to authorized_keys, attempts to enable the local SSH service and establish a reverse tunnel to 134.209.82.225, installs persistence mechanisms such as a macOS LaunchAgent and a Windows scheduled task SysMon, and a background script retries the connection approximately every 60 seconds.
- Help Net Security AISelectedClaude Code Extension Poisoned, Implanted with a Persistent SSH Backdoor
Security firm Phorion says it found a tampered Anthropic Claude Code extension version 2.1.313 in the open-source extension marketplace Open VSX; this version implants an SSH backdoor on developers' machines. Cursor says the malicious version was listed on its extension marketplace for about 11 hours on October 29, 2026, affecting at most 5,000 users, and was not developed by Anthropic. The malicious code executes as soon as the extension loads, writes the attacker's SSH key into authorized_keys and establishes an outbound tunnel, sets up persistence on three platforms, and also exfiltrates the hostname, Git email, public IP and the names of up to 40 environment variables suspected to be credentials. Cursor says that on most Mac and Windows hosts the attacker could not log in through the tunnel, and that it has taken the attacker's server offline and rebuilt the extension marketplace.
- SocketCursor removes malicious Claude Code 2.1.313 extension from its extension marketplace
Cursor confirmed that on October 29 its extension marketplace hosted a malicious Claude Code extension labeled 2.1.313, potentially affecting up to 5,000 users; it has now been removed and remediation guidance published. An earlier OpenSourceMalware analysis said the macOS version of the extension would add SSH authorized keys, attempt to establish a reverse SSH tunnel and install persistence, but the Open VSX channel it initially pointed to was refuted by Socket's verification: Socket checked 3,392 change events on Open VSX since October 27 and npm's publication records, and found no trace of 2.1.313 being published or taken down, and the Linux and Windows download sizes in the initial report's screenshots match the publicly available 2.1.314 version, so Socket suspects the screenshots were edited or made for illustration.
- The Hacker NewsSelectedOfficial Claude Code Extension in the Cursor Extension Marketplace Was Implanted with a Persistent SSH Backdoor
The Cursor extension marketplace was compromised, and a trojanized version of the official Claude Code extension was distributed that plants a persistent SSH backdoor on users' hosts; Cursor says at most 5000 users are affected. The version calls itself anthropic.claude-code 2.1.313, writes an attacker SSH key disguised as svc-telemetry into ~/.ssh/authorized_keys, establishes a reverse tunnel to 134.209.82[.]225, and achieves persistence via scheduled tasks, crontab, or LaunchAgent, while uploading over unencrypted HTTP the public IP, hostname, global Git email, and up to 40 environment variable names containing KEY, TOKEN, SECRET, PASS, AWS, or GCP. Cursor says that on most macOS and Windows hosts the attacker may be unable to log in through the tunnel, but still recommends affected users isolate their hosts, delete unauthorized keys, and rotate credentials.
- Unite.AISelectedCursor discloses malicious Claude Code extension attempting to install SSH backdoor
Cursor disclosed on October 29 that a maliciously modified version Anthropic.claude-code 2.1.313 appeared in its VS Code extension marketplace; the package was not developed by Anthropic, collects host information and attempts to install a persistent SSH backdoor, with up to 5000 users affected. The malicious version was listed from approximately 2:27 to 13:35 (Pacific Time) on October 29 and attempts to add an attacker-controlled SSH key to authorized_keys and establish a reverse tunnel; Cursor said that due to an error in the malicious code, this step fails except in rare cases such as running with administrator privileges, but the extension still installs a persistence mechanism and sends host information back. Cursor has taken down the malicious version, shut down and rebuilt the marketplace, worked with the cloud service provider to take the attacker's server 134.209.82.225 offline, and said there is no evidence that other versions or official distribution were affected.
- Unite.AISelectedCursor discloses malicious Claude Code extension attempting to install SSH backdoor
Cursor disclosed that a maliciously modified Anthropic.claude-code 2.1.313 extension appeared in its VS Code extension marketplace, attempting to install a persistent SSH backdoor, with up to 5,000 users affected. The version was listed from approximately 2:27 AM to 1:35 PM Pacific Time on October 29, 2026, and would collect hostname, username, Git email, public IP and other information, add the attacker's SSH key to authorized_keys and attempt to establish a reverse tunnel; Cursor said that due to an error in the malicious code, the process would fail unless Cursor is run with administrator privileges. The malicious code achieved persistence via macOS LaunchAgent, Windows scheduled tasks and the like, and sent host information and backdoor status back to port 8099 at 134.209.82.225.
- Netskope Threat LabsSelectedTrojanized Claude Code extension appears in the Cursor marketplace
A malicious Claude Code IDE extension not built by Anthropic, anthropic.claude-code 2.1.313, appeared in the Cursor extension marketplace on October 29, 2026, and an estimated maximum of 5,000 users installed it before Cursor took it down. The build prepends a loader in extension.js that, when the IDE starts, collects the hostname, user, Git email, public IP and environment variables whose names match KEY|TOKEN|SECRET|PASS|AWS|GCP, writes the attacker's SSH public key into authorized_keys, establishes a persistent reverse SSH tunnel and installs persistence, then sends host information back to the C2 via port 8099. Netskope recommends that users who installed it, in addition to uninstalling the extension, check SSH keys, persistence files and tunnel processes and rotate credentials, and that the C2 IP 134.209.82[.]225 can be used to locate affected hosts in network events.
- StepSecuritySelectedTrojanized Claude Code extension delivers persistent SSH backdoor to developer machines
On October 29, 2026, the Claude Code VS Code extension anthropic.claude-code 2.1.313 was implanted with a malicious loader in the Open-VSX registry and, via mirror synchronization, entered the Cursor extension marketplace; according to Cursor's statistics, at most 5000 users received that version within a window of about 11 hours. StepSecurity confirmed through sandbox analysis that when this version loads, it writes the attacker's SSH key, installs persistence for different operating systems, establishes a reverse SSH tunnel to a C2 (134.209.82.225), and sends host reconnaissance information back over plaintext HTTP. According to Cursor's notice, this malicious version was not developed or published by Anthropic, and how it entered the registry has not yet been publicly determined; Cursor took down the version and rotated keys on October 29, a clean 2.1.314 was released on October 30, and the C2 has been taken offline.
- SophosMalicious Claude Code extension distributed through the Cursor marketplace
Cursor reported on October 29 that a malicious version 2.1.313 of the Anthropic Claude Code extension had been listed on the Cursor extension marketplace, from approximately UTC 09:27 to 20:35, with an estimated maximum of 5000 macOS and Windows users affected. Phorion's analysis shows that the extension adds an attacker-controlled SSH key to authorized_keys, attempts to establish a reverse SSH tunnel to 134.209.82[.]225, establishes persistence, and sends host information to the attacker. Due to a code error, the SSH enabling step failed on most macOS and Windows hosts. Sophos X-Ops recommends checking Cursor hosts that installed 2.1.313 within the exposure window; merely uninstalling the extension still leaves a backdoor, and SSH keys, persistence mechanisms, and tunnel processes need to be removed, and accessible credentials rotated.
- Date not givenopensourcemalware.comSelectedClaude Code extension version 2.1.313 in the Cursor Marketplace was trojanized, installing an SSH backdoor
On October 29, 2026, a malicious version 2.1.313 of the Claude Code extension appeared in the Cursor Marketplace, whose main JS package inserted a 66-line malicious loader before legitimate code, installing a persistent SSH backdoor on users' machines. Cursor told OpenSourceMalware that the extension suffered some form of compromise that day and that the malicious version originated from this rather than Open-VSX, and Cursor has issued a notice about the incident; the @anthropic-ai/claude-code NPM package, the OpenVSX version, and the Microsoft VSCode version of the Claude extension do not contain malicious code. The article provides IOCs such as file hashes, SSH key fingerprints, and C2 addresses as well as troubleshooting and remediation recommendations, and states that the analysis only proves the sample is malicious and does not confirm that Anthropic's official release or distribution infrastructure was compromised.
Related discussion
- X@SecurityWeek · SecurityWeekMalicious Claude Code Extension Served in Cursor Supply Chain Attack https://www.securityweek.com/malicious-claude-code…(opens the original post in a new tab)
4 likes · 5 comments·Nov 3 11:40Collect
- X@DarkReading · Dark ReadingDevs Hit by Trojanized Claude Code Extension for Cursor https://bit.ly/4zpeYUU by Nate Nelson(opens the original post in a new tab)
3 likes · 3 comments·Nov 3 11:40Collect
- RedditReddit r/cybersecurityThe Cursor’s Claude Code Incident(opens the original post in a new tab)
- WebGigazineSSH backdoor found in “Claude Code” in Cursor's official marketplace(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)Malicious Claude Code Extension Served in Cursor Supply Chain Attack(opens the original post in a new tab)
- WeChatDoonsecA malicious Claude Code extension has appeared in the Cursor app marketplace, capable of implanting a persistent SSH backdoor on Windows and macOS(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS(opens the original post in a new tab)
- WebBoannews (Korea)커서 마켓에 변조된 ‘클로드 코드’ 올라와... 최대 5000명 설치(opens the original post in a new tab)
- WeChatDoonsecSample analysis report on the Cursor malicious extension incident (Claude Code)(opens the original post in a new tab)
- WeChatDoonsecRisk advisory regarding malicious Claude Code extensions in the Cursor VS Code extension marketplace(opens the original post in a new tab)
- WeChatDoonsecSample analysis report on the Cursor malicious extension incident (Claude Code)(opens the original post in a new tab)
- WeChatDoonsecClaude official extension poisoned to implant a persistent SSH backdoor(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 30: 138 new sources (12 outlets, 126 accounts)
- Oct 31: 217 new sources (14 outlets, 203 accounts)
- Nov 1: 12 new sources (1 outlets, 11 accounts)
- Nov 2: 3 new sources (3 outlets, 0 accounts)
- Nov 3: 2 new sources (0 outlets, 2 accounts)