Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Ravie LakshmananOct 30, 2026Malware / Artificial Intelligence Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut down its marketplace to remove the compromised package. The exact method attackers used to introduce the unauthorized update remains unclear. "We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users," Cursor said. "This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor[.]com/marketplace, Grok Bot, Grok, or our other SpaceXSI product. However, Cursor's statement that the malicious version "was not developed by Anthropic" misses the point. The attackers distributed it as version 2.1.313 under Anthropic's legitimate Claude Code extension ID (anthropic.claude-code), rather than as a separate fake extension. "The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News. The malicious update was distributed only through Cursor's marketplace, with no evidence that it reached Open VSX or Microsoft's official VS Code Marketplace. Users who installed Claude Code through either of those marketplaces are not known to be affected by this incident. As of October 30, 2026, the malicious version has been removed, and Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace. The extension is designed to activate after VS Code startup and when its webview opens, then proceeds to add an attacker-controlled key to the user's "~/.ssh/authorized_keys" file. The key is labeled "svc-telemetry" in an attempt to make it appear harmless. Subsequently, it attempts to make the victim reachable through SSH across Windows, Linux, and macOS, establishes a reverse tunnel to "134.209.82[.]225," installs platform-specific persistence in the form of a scheduled task, crontab, and LaunchAgent, and transmits host reconnaissance data to "134.209.82[.]225:8099/beacon" on port 8099 over an unencrypted HTTP request. "Turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts," the SpaceXAI-owned company said in its own analysis of the incident. "On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension still adds the attacker's SSH key, installs persistence, and sends host details to the attacker. Follow the remediation steps below regardless." Home directory and current working directory Global Git email from git config --global user.email Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP "Environment-variable values are not placed directly in the initial beacon," security researcher Paul McCarty said. "Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly." No other follow-on payloads have been observed. That said, the establishment of a reverse tunnel provides a pathway to the victim's SSH service, allowing the operator to issue commands or transfer files. "It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware," Gile said. Cursor has revealed that the incident has affected at most 5,000 users who installed the malicious version between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The company also said that it will be reaching out to impacted users directly. Users who have installed the compromised extension during the window are advised to isolate the hosts, remove the unauthorized SSH key and persistence mechanisms, and rotate credentials and sessions. The disclosure comes a little over a week after an unknown attacker replaced the release binaries of five already-published versions of OVHcloud's official CLI ("ovh/ovhcloud-cli") with a secret-stealing malware after uploading them through a GitHub account of a legitimate OVH contributor ("HassenBF") hijacked in March 2026 as part of the GlassWorm operation. (An earlier version of the story stated that the extension on the Open VSX registry was compromised. The incident has since been traced back to a compromise of the Cursor VS Code Marketplace.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Backdoor, Cyber Attack, Malware, Software Security, Supply Chain Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them