Official Claude Code Extension on Cursor's Marketplace Swapped for a Version with an SSH Backdoor

Security researchers have disclosed a compromise of Anthropic's official Claude Code extension for VS Code. The malicious version planted a persistent SSH backdoor on infected machines. The Open VSX registry was initially named as the source, but the incident was later traced to a breach of Cursor's extension marketplace. The company briefly took the service offline to remove the malicious package.

Cursor said at most 5,000 users were affected. These are people who installed the malicious version on October 29, 2026, between roughly 2:27 a.m. and 1:35 p.m. Pacific Time. According to the company, the malicious version was not developed by Anthropic, and other extensions in the marketplace were not affected. Cursor says it will contact impacted users directly.

How the attack worked

Jenn Gile, co-founder of OpenSourceMalware, said the package identified itself as anthropic.claude-code version 2.1.313. However, its main JavaScript bundle placed a 66-line malicious loader in front of the legitimate code. That version has since been removed, and Anthropic has published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.

The extension activated when VS Code started and when its webview opened. It then added an attacker-controlled key to the ~/.ssh/authorized_keys file. To look innocuous, the key carried the label "svc-telemetry."

Next, the malware tried to make the machine reachable over SSH on Windows, Linux, and macOS. It opened a reverse tunnel to 134.209.82[.]225 and installed persistence. On Windows it used a scheduled task, on Linux a crontab entry, and on macOS a LaunchAgent. Host details were sent to port 8099 at the same address over unencrypted HTTP.

In its own analysis, Cursor notes that enabling the local SSH service requires administrator rights. On most macOS and Windows machines the extension lacks those rights, so the attacker could not have logged in through the tunnel there. Even so, the key, the persistence mechanisms, and the data exfiltration still take effect. The company therefore advises following the remediation steps in all cases.

What was collected

The malware sent:

• the public IP address (via api.ipify[.]org);
• the hostname and local username;
• the operating system and CPU architecture;
• the home and current working directories;
• the global Git email address;
• the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP.

Researcher Paul McCarty notes that variable values were not included in the initial beacon. Still, the names alone can reveal which cloud providers, CI systems, and credential types are in use. More importantly, successful SSH access would let the operator inspect the account directly.

No additional payloads have been observed so far. Even so, the reverse tunnel opens a path to the victim's SSH service, and with it the ability to run commands and transfer files. Gile warns that although the package was pulled very quickly, anyone with Claude Code auto-updates enabled could have received it.

Affected users are advised to isolate their machines and remove the unauthorized SSH key and persistence mechanisms. They should also rotate credentials and sessions.

The incident came a little over a week after another supply-chain attack. In that case, an unknown attacker replaced the release binaries of five already-published versions of OVHcloud's official CLI with secret-stealing malware. The attacker used the GitHub account of a legitimate contributor, hijacked in March 2026 as part of the GlassWorm campaign.

Source: The Hacker News