Claude Code extension update planted an SSH backdoor
A malicious Claude Code extension update distributed through Cursor's extension marketplace attempted to give an unknown attacker persistent remote access to affected development systems. Cursor's revised security notice identifies versions 2.1.312 and 2.1.313 for Windows and macOS as affected. The unauthorized releases appeared under the legitimate extension identifier, anthropic.claude-code, rather than as a separate imitation package.
Cursor said the incident affected at most 5,000 users who installed the compromised software between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The company temporarily closed its marketplace to remove the package and said it would contact affected users directly. The method used to publish the altered extension under Anthropic's identity, and the full level of access obtained by the attacker, remain unknown.
OpenSourceMalware found that version 2.1.313 identified itself as the legitimate package but contained a 66-line malicious loader placed ahead of the normal extension code. The loader ran when the extension module loaded, including after Visual Studio Code startup and when the extension's webview, an embedded panel inside the editor, opened. It then added an attacker-controlled entry labelled "svc-telemetry" to ~/.ssh/authorized_keys, a file that lists which Secure Shell (SSH) credentials may remotely access an account.
The code also tried to enable the local SSH service on Windows, Linux and macOS, create a reverse tunnel to 134.209.82[.]225, and arrange persistence so it would run again later. A reverse tunnel is an outbound connection that can make a service on the affected computer reachable from a remote system. The persistence method varied by operating system, using a scheduled task on Windows, crontab on Linux and a LaunchAgent on macOS.
Administrative rights are normally needed to enable the SSH service on most Windows and macOS computers, according to Cursor's analysis. On systems where the extension lacked those rights, that step failed and the attacker could not sign in through the tunnel. However, failure to establish remote access did not prevent the loader from adding the unauthorized SSH entry, creating startup artifacts or sending information about the computer. Microsoft similarly cautioned that successful access depended on system privileges, SSH settings and the attacker's server configuration.
The extension sent a beacon, meaning a short report from the infected system, by unencrypted HTTP to 134.209.82[.]225:8099/beacon. The report included the public IP address obtained from api.ipify[.]org, the hostname, local username, operating system, CPU architecture, home directory, current working directory and the global Git email address. It also listed the names of as many as 40 environment variables whose names contained KEY, TOKEN, SECRET, PASS, AWS or GCP. Environment variables are settings that programs can use to hold configuration or credentials.
Researchers said the initial beacon did not include the values stored in those variables. Their names could nevertheless disclose which cloud providers, continuous integration systems or credential types were configured. If remote SSH access succeeded, the operator could inspect the account directly, execute commands or transfer files. No additional payloads were observed.
Anthropic said its systems and employee laptops were not compromised. It attributed the publication to a malicious actor who used access to Cursor's marketplace, where the tampered extension remained available for close to 12 hours. There is no evidence that the malicious releases reached Open VSX, Microsoft's Visual Studio Marketplace or the anthropic-ai/claude-code package on npm. Socket reviewed registry records and its ingestion logs and likewise found no evidence that version 2.1.313 became publicly available through Open VSX during the examined period.
As of October 30, 2026, the malicious release had been removed. Version 2.1.314 was the latest version published by Anthropic through Open VSX and Microsoft's marketplace. Cursor said it rotated its keys, rebuilt the marketplace and worked with the cloud provider to take the attacker's server offline, leaving the reverse shell non-functional. It also said no other marketplace extensions were maliciously changed.
Removing or updating the extension alone is not sufficient because the malicious code wrote files and settings outside the extension's installation folder. Microsoft advises affected organizations to preserve evidence, disconnect affected systems, remove unauthorized SSH entries, scripts, tunnel identities and startup items, review endpoint records, and rotate credentials or revoke active sessions. This applies to systems that installed or automatically updated to versions 2.1.312 or 2.1.313 through Cursor's marketplace.
For businesses assessing development systems and response procedures after an incident like this, AEU-I offers security-first IT, infrastructure and consulting. The case also follows a separate software supply chain incident disclosed a little over a week earlier, in which an unknown attacker replaced release files for five existing versions of OVHcloud's official command-line tool after a legitimate contributor's GitHub account had been hijacked in March 2026 as part of the GlassWorm operation.