Cursor Says Trojanized Claude Code Extension Was Live About 11 Hours, Affecting Up to 5,000 Users

A modified version of Anthropic's Claude Code extension, labeled 2.1.313, ran code meant to install a persistent SSH backdoor on developer machines. Cursor disclosed the incident on October 29, 2026, and said it affected at most 5,000 users.

The package carried the legitimate extension ID, anthropic.claude-code. It was not a lookalike under a different name.

What Cursor says happened

Cursor said the malicious version was available on its marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on October 29. That is roughly 11 hours.

"This malicious version of the extension was not developed by Anthropic," Cursor said in its security notice. The company said it removed the package on detection, blocked further distribution, then shut down the entire marketplace as a precaution.

Cursor said it audited access, found no other extensions tampered with, rotated its keys, rebuilt the marketplace and brought it back online. It also said it worked with the cloud provider hosting the attacker's server to take that server offline. Cursor says the reverse shell and the data upload no longer function.

Versions 2.1.312 and 2.1.314 have been verified clean. Anthropic has published 2.1.314 to both Open VSX and the Microsoft VS Code Marketplace.

How the malware worked

Jenn Gile, co-founder of OpenSourceMalware, said the package's main JavaScript bundle contains a malicious 66-line loader inserted ahead of the legitimate extension code. The rest of the bundle looks normal.

Phorion CEO Calum Hall said the injected code runs as soon as Node loads the file. The user does not have to start a Claude conversation or touch the extension.

The code appends an attacker-controlled key, labeled "svc-telemetry," to the user's ~/.ssh/authorized_keys file. It then tries to turn on the local SSH service and opens a reverse SSH tunnel to 134.209.82.225. Background scripts retry that tunnel about every 60 seconds.

Persistence differs by platform. On macOS it installs a LaunchAgent with an Apple-style name, com.apple.sysmond. On Linux it adds a cron entry. On Windows it tries a scheduled task called SysMon and falls back to the Startup folder.

The extension also sends the following to the attacker over unencrypted HTTP on port 8099:

• Hostname and username
• Operating system and architecture
• Home and working directories
• Git email address
• Public IP address
• Names of up to 40 environment variables that look like keys, tokens, passwords or AWS and GCP credentials

The variable values stay on the machine. Hall noted that the names still give an operator a list of which hosts hold cloud credentials or API tokens.

The bug that limited the damage

Cursor said turning on the local SSH service requires administrator rights the extension does not have on most macOS and Windows hosts. On those machines, Cursor said, the attacker could not have logged in through the tunnel.

Phorion traced the macOS failure to a faulty check. A standard-user query of Remote Login returns an administrator-access error instead of "Off," so the script skips the enabling step.

Hall cautioned that the bug is no defense. A Mac that already has Remote Login enabled would be exposed. And as Cursor acknowledged, on every affected machine the extension still adds the attacker's key, installs persistence and sends host details out.

Open questions on scope and cause

The sources differ on where the bad build appeared. Cursor and Phorion place it on the Cursor Marketplace. Help Net Security and ThreatDefence say Phorion spotted it on Open VSX, the Eclipse Foundation's registry used by Cursor, Windsurf and VSCodium.

OpenSourceMalware said the Open VSX extension, the Microsoft VS Code extension and the @anthropic-ai/claude-code npm package are not malicious. It also said its findings show this specific artifact is malicious but do not demonstrate that Anthropic's official release infrastructure was compromised. ThreatDefence wrote that until Anthropic confirms, that question stays open.

Cursor said it has no evidence other versions of the extension or the official distribution are affected. The Hacker News reported that the method attackers used to introduce the update remains unclear. Cursor has not said how a modified build got published under the legitimate extension ID.

What affected users are told to do

Cursor advised anyone who installed or updated to 2.1.313 from its marketplace during the window to run its impact check, search endpoint, network and extension-installation telemetry for the published indicators, and isolate any host showing evidence of compromise. The company said it will contact affected users directly.

ThreatDefence's guidance is blunter. Uninstalling the extension does not remove the SSH key, the tunnel or the LaunchAgent. It recommends checking for the svc-telemetry line in ~/.ssh/authorized_keys, blocking 134.209.82.225 on TCP ports 22 and 8099, and isolating affected machines before deleting anything. It also advises rotating every credential reachable from the machine, from a clean computer. Its advice is to rebuild the Mac rather than rely on deleting known files.

The unanswered question is how the build got onto the listing. Neither Cursor nor Anthropic has publicly said which account, key or process was abused.

The number to watch is Cursor's "at most 5,000." It is a ceiling, and the company has not said how many users actually installed the build.