Anthropic: 5,000 Users Exposed to Trojanized Claude Code Extension with SSH Backdoor on Cursor Marketplace

A maliciously modified copy of Anthropic's official Claude Code VS Code extension, version 2.1.313, was distributed through the Cursor VS Code extension Marketplace for roughly 11 hours on October 29, 2026, installing a persistent SSH backdoor on developer machines before it was pulled, Cursor disclosed in a security notice published the same day. Cursor says at most 5,000 users were affected and that it will reach out to them directly. The trojanized package, packaged as anthropic.claude-code version 2.1.313, was not developed by Anthropic, which has since published a clean version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace, according to The Hacker News, which reported the incident on October 30, 2026.

What was the specific vulnerability?

The vulnerability was a trojanized distribution: a malicious 66-line loader inserted into the extension's main JavaScript bundle ahead of the legitimate extension code, turning a trusted developer tool into a delivery vehicle for a persistent backdoor. According to Jenn Gile, co-founder of OpenSourceMalware, "The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code."

Once activated, after VS Code startup and when the extension's webview opens, the payload appends an attacker-controlled SSH key labeled "svc-telemetry" to the user's ~/.ssh/authorized_keys, a name chosen to make the entry appear harmless. It then attempts to enable the local SSH service and opens a reverse SSH tunnel to the attacker server 134.209.82[.]225 over TCP 22 using the user tunnel@. Persistence is installed per platform: a LaunchAgent on macOS, and on Windows a scheduled task attempting to run as SYSTEM with a Startup-script fallback. Background scripts retry the tunnel roughly every 60 seconds, and host details are beaconed via HTTP POST to 134.209.82[.]225:8099/beacon over unencrypted HTTP, per the OpenSourceMalware research disclosure.

How was the incident detected?

The incident was detected and disclosed by Cursor on October 29, 2026, the same day as the distribution window, which ran from about 2:27 a.m. PT to 1:35 p.m. PT, according to Cursor's security notice. Analysis was contributed by OpenSourceMalware and security researcher Paul McCarty, and the story was reported by The Hacker News's Ravie Lakshmanan on October 30, 2026. The modified VSIX hashes were published for verification: SHA-256 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 for darwin-arm64 and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 for win32-x64.

What is the current impact?

The current impact is contained at the supply-chain level but unresolved on end-user machines: the malicious version is removed, the marketplace is rebuilt and back online, and the attacker server no longer functions, yet affected hosts still carry the attacker's SSH key and persistence scripts until users clean them manually. Cursor removed the malicious version immediately upon detection, fully shut down the VS Code Marketplace out of caution, audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace, and worked with the hosting provider to take 134.209.82[.]225 offline. "The attacker server no longer functions," Cursor stated in its security notice.

Data collected by the beacon includes the public IP via api.ipify[.]org, hostname, local username, OS and CPU architecture, home directory and current working directory, global Git email, and the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP. According to Paul McCarty, "Environment-variable values are not placed directly in the initial beacon... More importantly, successful SSH access would allow the operator to inspect the account directly."

Cursor's own analysis limits the worst-case outcome: the SSH-service step "requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension still adds the attacker's SSH key, installs persistence, and sends host details to the attacker," per The Hacker News.

What are the next steps?

The next steps for affected users are to isolate hosts, remove the unauthorized SSH key and persistence mechanisms using remediation scripts provided for macOS and Windows, and rotate credentials and sessions from a trusted system. Uninstalling the extension alone is not enough: "Uninstalling the extension may not be sufficient; the payload drops standalone persistence scripts that keep running," the disclosure states. Jenn Gile warned, "It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware." The disclosure comes a little over a week after the GlassWorm operation, in which an attacker hijacked the GitHub account of a legitimate OVH contributor, "HassenBF", in March 2026 and replaced release binaries of five published versions of OVHcloud's official CLI with secret-stealing malware.

By the numbers

Source snapshot