Trojanized Claude Code Update on Cursor Marketplace Planted SSH Backdoor for Up to 5,000 Users

TL;DR

• what: An attacker used access to Cursor's marketplace to publish a trojanized Claude Code extension under Anthropic's legitimate ID, anthropic.claude-code.
• impact: Up to 5,000 users installed it between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, exposing their hosts to an unauthorized SSH key, persistence and host reconnaissance.
• fix: Cursor removed the package, rotated its keys, rebuilt the marketplace, had the attacker's server taken offline and is contacting affected users directly, while its advisory calls for host isolation, removal of the key and persistence, and credential and session rotation.
• who: Cursor users who installed anthropic.claude-code versions 2.1.312 or 2.1.313 from the Cursor Marketplace during the window are at risk; no evidence shows the update reached Open VSX or the Microsoft VS Code Marketplace.

Up to 5,000 developers installed a tampered Claude Code extension from Cursor's marketplace on October 29, 2026. The update was built to add an attacker's SSH key to the user's account, install persistence and open a reverse tunnel to an attacker-controlled server. It carried Anthropic's real extension ID, so it arrived as a routine update, not as a lookalike package.

What happened

The malicious package identified itself as anthropic.claude-code version 2.1.313. Jenn Gile, co-founder of OpenSourceMalware, said its main JavaScript bundle contained a 66-line loader inserted ahead of the legitimate extension code. Because the real code remained in the package, the extension was not a separate fake product but a modified copy of the real one.

Cursor said the package was live from about 2:27 a.m. to 1:35 p.m. PT, roughly 11 hours by those timestamps. Anthropic described the exposure as close to 12 hours. Cursor temporarily shut down its marketplace to remove the package. Gile noted that the removal was fast, but that any Claude Code instance set to auto-update could still have pulled the malware during that window.

Anthropic said the incident did not involve a compromise of its systems or employee laptops. According to the company, a malicious actor used access to Cursor's marketplace to publish the tampered build. There is no evidence the update reached Open VSX or the Microsoft VS Code Marketplace, where Anthropic's latest published version is 2.1.314.

How the backdoor works

The loader activates after VS Code startup and when the extension's webview opens. From there, it runs a sequence of steps aimed at long-term remote access:

• Adds an attacker-controlled key to ~/.ssh/authorized_keys, labeled svc-telemetry to look harmless.
• Attempts to make the host reachable over SSH on Windows, Linux and macOS.
• Establishes a reverse tunnel to 134.209.82[.]225.
• Installs platform-specific persistence: a scheduled task, a crontab entry or a LaunchAgent.
• Sends host reconnaissance to 134.209.82[.]225:8099/beacon over unencrypted HTTP.

What the beacon collects

The initial beacon is reconnaissance, not bulk credential theft. It contains:

• Public IP address, retrieved from api.ipify[.]org
• Hostname and local username
• Operating system and CPU architecture
• Home directory and current working directory
• Global Git email address
• Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP

Security researcher Paul McCarty said environment variable values are not placed directly in the beacon, but the names can still reveal which cloud providers, CI systems and credential types are configured. That turns the beacon into a triage feed: an operator can see which hosts are worth logging in to. McCarty added that successful SSH access would let the operator inspect the account directly.

⚠️ Taking down the package did not clean the hosts — Removing the package from the marketplace stops new installs. It does not undo what the loader already wrote to a machine. Cursor says the attacker's server is offline and the reverse shell no longer functions, but the unauthorized key and persistence stay in place until they are removed. Cursor's advisory calls for host isolation, removal of both, and rotation of credentials and sessions.

Where the attack chain breaks

Not every step succeeded on every host. Cursor said enabling the local SSH service requires admin rights, which the extension does not have on most macOS and Windows machines. "On those hosts the step fails and the attacker could not have logged in through the tunnel," the company said. It added that the extension still adds the SSH key, installs persistence and sends host details to the attacker.

That limit is real but conditional. It depends on the local SSH service being off and the user lacking admin rights. Developer workstations with local admin, or with SSH already enabled, fall outside the most reassuring version of Cursor's statement. Where the tunnel did connect, it gave the operator a path to the victim's SSH service, allowing command execution and file transfer. No follow-on payloads have been observed, though that finding does not by itself establish that no operator logged in to any host.

Scope is still moving

Cursor's advisory has already changed once. It first listed only version 2.1.313, then expanded to versions 2.1.312 and 2.1.313 distributed through the Cursor Marketplace for Windows and macOS. Published technical analysis describes the 2.1.313 package and does not explain what 2.1.312 contained.

One gap needs clarifying. Researchers describe code paths for Linux, including a crontab persistence mechanism, while the updated advisory names only Windows and macOS builds as affected. The available reporting does not explain the difference. Cursor also said no other extensions were maliciously modified.

Vendor response

Cursor removed the malicious version, rotated its keys and rebuilt the marketplace. It worked with the cloud provider to take the attacker's server offline and says it will contact affected users directly. Anthropic says it is working with Cursor on the incident.

Several questions remain unanswered, starting with how the attacker obtained publishing access. Cursor's key rotation and marketplace rebuild indicate a serious platform-level response, but no root cause has been published. Until one is, the claim that other extensions were untouched rests on Cursor's own review.

Why this matters

The incident shows that a publisher's identity is only as strong as the distribution channel carrying it. Anthropic's own systems were not breached, and the official channels stayed clean. Even so, a third-party marketplace was able to ship modified code under Anthropic's extension ID, and auto-update delivered it with no action required from the user.

Why developer endpoints are the target — The beacon's field list shows what the operator wanted to learn: cloud accounts, CI systems, tokens and Git identity. A single workstation can hold access well beyond its own disk, which makes an IDE extension a direct route toward source code and cloud environments.

It also fits a pattern of attackers abusing trusted release paths. A little over a week earlier, an unknown attacker replaced the release binaries of five already-published versions of OVHcloud's official CLI with secret-stealing malware. Those binaries were uploaded through the GitHub account of a legitimate OVH contributor, hijacked in March 2026 as part of the GlassWorm operation. No reporting so far connects that case to the Cursor incident, but both show the same weakness: the package name and publisher looked right because the attacker controlled a legitimate path for publishing.

Originally published on RedEye Threat Intelligence.