Malicious Claude Code extension on Cursor planted SSH backdoors

Summary

A malicious package presented as Anthropic's Claude Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, 2026. The reported exposure window was 2:27 a.m. to 1:35 p.m. Pacific Time, and the malicious version was 2.1.313. Up to 5,000 developers were potentially exposed; that figure should not be treated as a confirmed infection count or a count of successful remote-access compromises.^[0]

The package contained a JavaScript loader prepended to extension.js while leaving the legitimate extension code otherwise unchanged. Loading the extension was sufficient to execute the malicious code, without interaction with Claude Code. The payload collected reconnaissance, installed an attacker-controlled SSH key, attempted to enable SSH and establish a reverse tunnel, and installed platform-specific persistence that retried the tunnel roughly every minute.^[0]

Implementation errors limited the backdoor's effectiveness on systems where SSH was not already running. The macOS routine mishandled an administrator-access error, while the Windows routine attempted to invoke PowerShell through an unavailable Unix shell. These failures did not make affected hosts clean: key installation, persistence, and reconnaissance transmission could still occur. The script reported host information and backdoor status to 134.209.82.225, but did not directly steal credential values.^[0]

Cursor removed the package, temporarily disabled its marketplace for an extension audit and access-key rotation, and worked with the hosting provider to take the attacker server offline. The report ultimately limited malicious distribution to Cursor and relayed Cursor's finding of no evidence affecting other extension versions or the official distribution. How the malicious package was published under Anthropic's name, and whether Cursor or Anthropic systems were compromised, remained unresolved.^[0]

Attack chain

1. 1. Malicious package distribution: Attackers made a modified Claude Code extension, version 2.1.313, available through Cursor's extension marketplace during the October 29 exposure window. The supplied report does not establish how they obtained the ability to publish it under Anthropic's name.^[0]
2. 2. Execution on extension load: A malicious JavaScript loader at the beginning of extension.js executed when the extension loaded. The legitimate extension code remained otherwise unchanged, and malicious execution did not require the user to interact with Claude Code.^[0]
3. 3. Host reconnaissance: The payload collected system and user information, including username, hostname, public IP address, Git email address, and names of environment variables associated with sensitive credentials. The report describes reconnaissance collection rather than direct theft of credential values.^[0]
4. 4. SSH backdoor preparation: The malware added an attacker-controlled SSH key and attempted to enable SSH access. On macOS, an unprivileged Remote Login status check caused it to skip activation. On standard Windows installations, invoking the PowerShell setup routine through /bin/sh caused setup to fail. These defects limited remote access when an SSH server was not already running.^[0]
5. 5. Persistent reverse-tunnel attempts: The payload attempted to establish a reverse SSH tunnel and installed persistence through a macOS LaunchAgent or a Windows scheduled task/Startup script. Persistence retried the tunnel roughly every minute. A tunnel could not provide access to the affected machine if its SSH server was not running.^[0]
6. 6. Reconnaissance and status reporting: Host details and backdoor status were sent to the attacker server at 134.209.82.225. Reconnaissance transmission could occur even when SSH access failed. The report suggests that attackers intended to retrieve sensitive material manually after gaining SSH access, but does not establish that such retrieval occurred.^[0]

Disclosure timeline

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Exposure, malicious-code execution, and successful SSH access are distinct outcomes. The reported 5,000-developer exposure ceiling should not be interpreted as 5,000 confirmed remote-access compromises.^[0]
• The SSH implementation bugs reduced access on some systems but did not eliminate the incident: keys, persistence, and reconnaissance transmission could survive a failed SSH setup attempt.^[0]
• Scope the incident to the malicious Cursor-distributed package described in the report. Initial claims involving npm, Open VSX, and Microsoft's marketplace were subsequently corrected, and Cursor reported no evidence affecting other versions or the official distribution.^[0]
• Attribution and the publication mechanism remain unresolved. Distribution under Anthropic's name does not establish that Anthropic developed the payload or that either Anthropic's or Cursor's systems were compromised.^[0]

Defensive actions

• Identify systems that downloaded Claude Code extension version 2.1.313 through Cursor during the reported October 29 exposure window.: The malicious package was distributed through that channel during a bounded interval. Treat the reported exposure population as a triage scope rather than proof that every exposed system received a working SSH backdoor.^[0]
• Check exposed systems for the svc-telemetry SSH key and inspect the reported persistence mechanisms: macOS LaunchAgents and Windows scheduled tasks or Startup scripts.: Key installation and persistence could remain even when the malware failed to enable SSH. The absence of successful remote access is therefore not sufficient to dismiss host impact.^[0]
• Review available network telemetry for communication with 134.209.82.225 during and after exposure.: The malware sent host details and backdoor status to this address, and the reported takedown disrupted both reconnaissance transmission and reverse SSH connections. Historical traffic can help identify affected hosts even though the server was reported offline.^[0]
• During triage, determine whether SSH was already enabled and running on affected machines.: The documented implementation errors primarily prevented enabling SSH where it was not already running. Systems with an existing SSH service cannot be assumed protected by those errors, while systems without one may still contain persistence and have transmitted reconnaissance.^[0]
• Isolate confirmed impacted machines and follow Cursor's incident-specific remediation instructions.: The report explicitly recommends isolation and vendor remediation. Removing the malicious marketplace package or taking down its server does not by itself establish that installed keys and persistence have been removed from endpoints.^[0]
• For impacted environments, rotate accessible secrets, invalidate sessions, and rebuild from safe backups.: These are the recovery measures recommended in the report. The script did not directly steal credential values, but its intended persistent SSH access creates a reason to address potentially accessible secrets rather than relying solely on the observed reconnaissance behavior.^[0]