Trojanized Claude Code extension distributed through Cursor marketplace

Threat summary

On October 29, 2026, Cursor disclosed that a malicious build of the Claude Code extension, version 2.1.313, was available in its marketplace between approximately 2:27am and 1:35pm (PT).

Cursor removed the package, temporarily took the marketplace offline, rotated its keys, and audited marketplace access, reporting no evidence that other extensions had been tampered with. Cursor estimates that up to 5,000 users were affected.

Claude Code is Anthropic’s AI coding assistant for Visual Studio Code (VS Code) and compatible editors. Extensions run with the permissions of the logged-in user and can access resources available to that user, including source code repositories, development tools, cloud credentials, and authentication tokens.

The incident did not involve exploitation of a vulnerability in Claude Code. Instead, a trojanized build was published under Anthropic’s legitimate extension identifier and distributed through the Cursor marketplace.

On October 30, 2026, Anthropic released version 2.1.314 following removal of the compromised package. Release notes for said version describe product fixes and enhancements but do not reference a software vulnerability, malware cleanup, or security patch.

Early reporting from OpenSourceMalware referenced Open VSX because researchers analyzed a sample obtained from that ecosystem. OpenSourceMalware later updated its findings after communication with Cursor and reported that the malicious package originated from the Cursor marketplace. Current reporting does not contain evidence that the Microsoft Visual Studio Code Marketplace, Open VSX, or npm distributions delivered a malicious version.

Researchers identified a 66-line loader injected ahead of the legitimate code in extension.js. The loader executes automatically when the extension loads and requires no further user interaction.

Analysis showed that it collects host information, adds an adversary-controlled SSH key to authorized_keys, attempts to enable the local SSH service, and attempts to establish a reverse SSH tunnel. It also installs platform-specific persistence mechanisms:

• LaunchAgents on macOS

• Scheduled tasks on Windows

• Cron-based persistence on Linux

Collected information includes hostnames, usernames, operating system details, working directories, Git configuration information, public IP addresses, and the names of environment variables commonly associated with credentials and cloud services.

Cursor reported that errors in the malicious code prevent key parts of the SSH backdoor from functioning on most Windows and macOS systems unless Cursor is running with administrator privileges. The malicious package nevertheless adds the adversary-controlled SSH key, installs persistence, and transmits host information to external infrastructure.

The loader does not download or execute additional payloads after installation. Researchers observed recurring tunnel reconnection attempts, but none of the public reports indicate successful follow-on activity through the SSH tunnel, and no threat actor has been publicly identified.

Analysis

The incident is tied to the distribution of a malicious Claude Code extension through the Cursor marketplace rather than exploitation of a vulnerability in Claude Code itself. The key question for responders is where developers got the extension, not whether they use Claude Code. A developer who used Cursor and installed or updated the extension during the window on October 29 is in scope.

The most exposed organizations are those whose Cursor users work on workstations with access to production cloud environments, source code repositories, continuous integration and continuous delivery (CI/CD) platforms, infrastructure management systems and privileged credentials. Within that group, the full SSH backdoor is most likely to work on hosts where Cursor runs with administrator rights, Macs with Remote Login enabled, and Linux workstations that already run an SSH server.

The threat actor leveraged trust in the software update process by distributing the malicious package through an official extension listing. Users who received the affected version were exposed without needing to download a suspicious file or interact with the extension beyond installation.

The primary concern for defenders is not the workstation itself but the credentials, repositories, cloud resources, and deployment systems accessible from that workstation. Potential downstream impact depends on the permissions available to the affected user and may include access to source code repositories, cloud environments, deployment pipelines, and administrative tooling reachable from the compromised system.

What is confirmed on affected machines is the information sent out, the added login key and the startup entries. Anything beyond that depends on what the developer had access to. The login key keeps working until someone deletes it, even after the extension is removed. A Linux workstation running SSH and reachable over a virtual private network (VPN) stays open to whoever holds the matching key. 

Mitigations

Identify systems that installed or updated the Claude Code 2.1.313 extension from the Cursor marketplace between 2:27am and 1:35pm (PT) on October 29, 2026. Reviewing installation and update logs for that period can focus investigations on hosts that received the affected package. Isolate affected systems and preserve forensic evidence before making changes to support response activities and determine the scope of exposure.  

Review affected hosts for published indicators of compromise, including:

• The svc-telemetry SSH key

• Connections to 134.209.82[.]225 on ports 22 and 8099

• Scheduled tasks such as SysMon

• The com.apple.sysmond LaunchAgent

• Cron-based persistence entries

• And related artifacts

Remove identified SSH keys, persistence mechanisms, and tunnel processes. Block communication with the published infrastructure and investigate systems that connected to it. Rotate cloud credentials, access tokens, repository credentials, and application programming interface (API) keys accessible from affected hosts.

Updating or uninstalling the extension does not remove SSH keys or persistence mechanisms already written to disk, so investigation and cleanup remain necessary after upgrading.

Upgrade affected installations to version 2.1.314 or later once remediation activities are complete, and monitor cloud environments, repositories, deployment systems, and administrative tooling for evidence of follow-on access.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up