Malicious Claude Code VS Code extension installed an SSH backdoor
Original title: Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
Cursor says at most 5,000 users got version 2.1.313 on October 29; Anthropic replaced it with 2.1.314.
Researchers say a modified Anthropic Claude Code extension on the Cursor Marketplace, also listed as anthropic.claude-code 2.1.313 on Open VSX, inserted a 66-line loader that was not Anthropic's code. After startup it adds an SSH key labeled svc-telemetry, tries to open SSH and a reverse tunnel to 134.209.82.225, installs scheduled-task, crontab, or LaunchAgent persistence, and beacons host details over unencrypted HTTP. Cursor briefly took the marketplace down; the malicious build was removed and version 2.1.314 published. On most macOS and Windows hosts the extension lacks admin rights, so enabling SSH fails, but the key, persistence, and beacon can still run.
Unconfirmed: Cursor's figure of at most 5,000 affected users is the company's own estimate.
- The install window was about 2:27 a.m. to 1:35 p.m. PT on October 29, 2026.
- The beacon goes to 134.209.82.225:8099 and includes Git email and secret-like variable names, not values.
- No other follow-on payloads have been observed.
- Cursor said it will contact impacted users directly.
- A separate OVHcloud CLI tampering tied to GlassWorm is mentioned only as prior context.
Impact: Persistent SSH access path plus host and account reconnaissance
| Product | Affected | Fixed in |
|---|---|---|
| Anthropic Claude Code VS Code extension | 2.1.313 | 2.1.314 |
- 1.Isolate hosts that installed the extension on October 29, 2026.
- 2.Remove the svc-telemetry SSH key and scheduled task, crontab, or LaunchAgent persistence.
- 3.Rotate credentials and sessions that may have been exposed.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1098.004 SSH Authorized KeysT1053.005 Scheduled TaskT1543.001 Launch AgentT1071.001 Web Protocols
- Products
- Claude Code VS Code extension
- Organizations
- OpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cursor.com | ic. It does not impact other extensions downloaded from the cursor[.]com/marketplace, Grok Bot, Grok, or our other SpaceXSI produc |
| ipv4 | 134.209.82.225 | indows, Linux, and macOS, establishes a reverse tunnel to " 134.209.82[.]225 ," installs platform-specific persistence in the form of |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts. The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware. "We identified a security incident
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.