Trojanized Claude Code Extension Slips Through Cursor Marketplace, Installs SSH Backdoor

Cybersecurity researchers have found that a tampered version of Anthropic's official Claude Code extension was pushed through the Cursor Marketplace disguised as a routine update, aiming to plant a persistent SSH backdoor on machines that installed it.

The rogue release, version 2.1.313, went out under the extension's real publisher identity, leading Cursor to briefly take its marketplace offline while the compromised package was removed. How the attackers managed to slip the unauthorized update in is still not known.

Cursor said the incident affected at most 5,000 users and that the malicious build was not developed by Anthropic. But that framing misses the core issue, according to OpenSourceMalware co-founder Jenn Gile: the package carried Anthropic's genuine extension ID, anthropic.claude-code, rather than posing as a separate fake. Its main JavaScript bundle held a 66-line malicious loader inserted ahead of the legitimate code, she said.

Once triggered after VS Code startup and when its webview opens, the extension adds an attacker-controlled key labeled "svc-telemetry" to the user's ~/.ssh/authorized_keys file, attempts to expose the victim to SSH across Windows, Linux and macOS, sets up a reverse tunnel to 134.209.82[.]225, and installs persistence via a scheduled task, crontab or LaunchAgent. It also sends host reconnaissance data to 134.209.82[.]225:8099/beacon over unencrypted HTTP.

Cursor noted that enabling the local SSH service needs admin rights the extension lacks on most macOS and Windows hosts, so that step fails there. Even so, the key, persistence and data exfiltration still occur. Stolen details include public IP, hostname and username, OS and CPU architecture, home and working directories, global Git email, and the names of up to 40 environment variables containing terms like KEY, TOKEN, SECRET, PASS, AWS or GCP.

The malicious version was removed as of October 30, 2026, and Anthropic published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace. Cursor said the affected users installed the bad build between roughly 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, and that it will contact them directly. Those who installed it are advised to isolate hosts, remove the unauthorized SSH key and persistence mechanisms, and rotate credentials and sessions.

The disclosure follows an incident a little over a week earlier in which an unknown attacker replaced release binaries of five published versions of OVHcloud's official CLI with secret-stealing malware, uploaded through a legitimate OVH contributor's GitHub account hijacked in March 2026 as part of the GlassWorm operation.

Source: The Hackers News