Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Malicious Claude Code Extension on Cursor Marketplace Installs SSH Backdoor

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Tampered Claude Code extension 2.1.313 was on Cursor marketplace for 11 hours on October 29, installing persistent SSH backdoor on up to 5,000 users.

A malicious build of Anthropic's Claude Code extension was published on Cursor's VS Code marketplace from about 2:27 AM to 1:35 PM PDT on October 29, 2026. The tampered version 2.1.313 injected JavaScript that added an Ed25519 SSH key labeled svc-telemetry, opened a reverse tunnel to 134.209.82.225, and persisted via launch items, cron, or scheduled tasks. It collected host details including hostname, username, OS, public IP, and Git email, plus names of up to 40 credential-like environment variables but not their values. Cursor removed the extension, temporarily shut down the marketplace, and reported at most 5,000 users affected; Anthropic confirmed its systems were not compromised.

Key facts
  • Version 2.1.313 available on Cursor marketplace October 29, 2026 from 2:27 AM to 1:35 PM PDT
  • Up to 5,000 users affected
  • Added SSH key svc-telemetry and reverse tunnel to 134.209.82.225
  • Collected hostname, username, OS, public IP, Git email and env var names
  • Persistence via macOS LaunchAgent, Linux crontab, Windows SysMon task
  • Loader runs before normal extension initialization
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Version 2.1.313 available on Cursor marketplace · Help Net Security
  2. Oct 29, 2026Extension attempts reverse SSH tunnel and persistence · Microsoft Security Blog
  3. Oct 29, 2026Cursor removes tampered extension and takes marketplace offline · The Decoder
  4. Oct 29, 2026Anthropic publishes version 2.1.314 · Ars Technica
  5. Oct 31, 2026Microsoft reports on injected backdoor details · Microsoft Security Blog
  6. Nov 2, 2026GBHackers confirms persistence mechanisms · GBHackers

What each outlet adds

beyond the shared facts
  • Help Net SecurityFirst spotted malicious extension and macOS SSH persistence details
  • The RegisterAnthropic confirms not compromised and staff statement
  • Dark ReadingLoader size and unrelated Cursor browser flaw mention
  • Microsoft Security BlogTechnical injection and collection specifics
  • GBHackersSpecific persistence examples and indicators
Vendors
CursorAnthropicGitHubMicrosoftOpenAI
Products
Claude Code extensionsCursor marketplaceanthropic.claude-codeClaude CodeOpen VSXCursorClaude VS Code extensionCursor VS Code Extension MarketplaceGitHub CopilotCodexVS CodeClaude Desktop
Malware
malicious Claude Code extensions
Victims
Cursor
Organizations
MicrosoftPhorionEclipse FoundationPhorianSpaceXOpenSourceMalwareAnthropicForever Security
AI models
Claude

Coverage

oldest first · one row per article · UTC
  1. · 12d ago Help Net SecurityFirst report

    Poisoned Claude Code extension on Open VSX planted an SSH backdoor

    Version 2.1.313 was on Cursor’s marketplace for about 11 hours; Cursor says at most 5,000 users were affected.

  2. · 12d ago Cyber Security News

    Embedded browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop flawed

    Forever Security’s EMBRACE findings show prompt injection, address spoofing, and local file reads; Codex and VS Code were still unpatched.