Tampered Claude Code extension on Cursor planted an SSH backdoor
Version 2.1.313 was downloadable for about 11 hours and could have reached up to 5,000 developers; official Anthropic channels were not affected.
74
- Mentions · 7d4
- Mentions · 30d4
- All mentions4
- First seenOct 30, 2026
- Last mentioned2h ago
Timeline
4 articles · newest firstMalicious Claude Code extension on Cursor planted SSH backdoors
Version 2.1.313 was listed for about 11 hours on October 29 and may have reached 5,000 developers.
74
Poisoned Claude Code extension on Open VSX planted an SSH backdoor
Version 2.1.313 was on Cursor’s marketplace for about 11 hours; Cursor says at most 5,000 users were affected.
78
Backdoored Claude Code 2.1.313 shipped to VS Code and Cursor
The build tried to plant a persistent SSH reverse tunnel before Anthropic replaced it with 2.1.314.
84
Appears with
- Anthropicvendor · 4
- Claude Codeproduct · 4
- Cursorvendor · 2
- Cursorproduct · 2
- Open VSXproduct · 1
- Cursorvictim · 1
- OpenSourceMalwareorganization · 1
- Eclipse Foundationorganization · 1
- Visual Studio Codeproduct · 1
- Microsoftorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.