Cursor: malicious Claude Code extension with SSH backdoor live 11 hours
Original title: Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours
Versions 2.1.312 and 2.1.313 collected host data and tried a reverse SSH tunnel; Cursor says most logins failed.
Cursor confirmed malicious Claude Code packages were on its VS Code Extension Marketplace for about 11 hours on October 29, 2026, targeting Windows and macOS. Anthropic did not build versions Anthropic.claude-code 2.1.312 and 2.1.313. The code gathered host details, added an SSH key labeled svc-telemetry, and tried a reverse tunnel, with persistence via a macOS LaunchAgent and a Windows scheduled task. Cursor removed the packages, rebuilt the marketplace, and said the attacker server was disabled.
Unconfirmed: Cursor says code errors and missing admin rights limited remote login on most hosts, and that no other extensions were altered.
- Packages were available from about 2:27 a.m. to 1:35 p.m. Pacific Time.
- Collection included hostname, username, OS, Git email, public IP, and environment variable names, not values.
- Enabling SSH needed elevated rights the extension usually lacked, limiting remote login on most hosts.
- Indicators include 134.209.82.225, TCP 22, and HTTP POST to port 8099 at /beacon.
- Cursor advises isolating hosts with payload evidence and rotating credentials from a trusted system.
Impact: SSH backdoor attempt and collection of host and user metadata
| Product | Affected |
|---|---|
| Anthropic Claude Code extension | 2.1.312 and 2.1.313 |
- 1.Remove the extension and leftover scripts; isolation is advised if payload execution is shown.
- 2.Check authorized keys for svc-telemetry and review extension, endpoint, and network logs.
- 3.Rotate accessible credentials and sessions from a trusted system.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1098.004 SSH Authorized KeysT1021.004 SSHT1543.001 Launch AgentT1053.005 Scheduled Task
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.82.225 | sh a shared attacker. Cursor’s published indicators include 134[.]209[.]82[.]225 , SSH connections on TCP port 22, and HTTP POST traff |
From the original article
2 min read at cybersecuritynews.com
Cursor has confirmed that malicious Claude Code extension packages were available through its VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The altered packages targeted Windows and macOS users and attempted to install an SSH backdoor for lasting remote access. According to Cursor’s security notice, the affected versions were Anthropic.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.