VULNpocalypse
HighSupply chainMonitoring

Trojanized Claude Code extension (2.1.312, 2.1.313) on Cursor marketplace installs persistent SSH backdoor

A tampered anthropic.claude-code build on the Cursor marketplace planted an SSH key, a reverse tunnel and persistence on up to 5,000 developer machines.

Published
Updated
Fixed in
No patch needed for official channels. Malicious versions removed from the Cursor marketplace. A clean Cursor-side version is not confirmed. Latest on Open VSX and Microsoft VS Code Marketplace is 2.1.314.
Exploitation
Yes. A malicious build was served to at most 5,000 Cursor users on October 29, 2026, and it wrote SSH keys and persistence. Successful attacker logins are not confirmed.

What happened

Cursor disclosed on October 29, 2026 that a tampered copy of the Claude Code extension (anthropic.claude-code) was served from its extension marketplace. Microsoft lists versions 2.1.313 and 2.1.312 and says the package was live from about 2:27 AM to 1:35 PM Pacific (Microsoft Security Blog). Cursor says at most 5,000 users were affected and that it will contact them directly (The Hacker News). Cursor first listed only 2.1.313 and later added 2.1.312 for Windows and macOS (The Hacker News).

Scope. Microsoft confirmed the malicious packages were never published or distributed from the Visual Studio Marketplace or from npm @anthropic-ai/claude-code, and says the evidence suggests the incident is limited to the Cursor marketplace (Microsoft Security Blog). Some early reports said the Open VSX build was compromised. That was later corrected (The Hacker News), and one researcher disputed it (Help Net Security). Socket found no evidence that 2.1.313 reached Open VSX (The Hacker News).

Who is responsible. Anthropic says its systems and employee laptops were not compromised. It says a malicious actor used access to Cursor’s marketplace to publish a tampered copy that Anthropic did not build or publish (The Register). How the attacker obtained that access and what else they could reach is not confirmed (The Hacker News).

What the loader does. A malicious JavaScript function runs before the legitimate extension code, when the module loads (Microsoft Security Blog). It attempts to:

  • Append an Ed25519 public key labeled svc-telemetry to authorized_keys.
  • Enable the local SSH service.
  • Open a reverse SSH tunnel with the arguments -N -R ‘*:0:localhost:22’.
  • Retry the tunnel every sixty seconds.
  • Write persistence outside the extension directory.
  • Send host details to the attacker.

(Microsoft Security Blog)

The destination is 134.209.82[.]225, with a beacon sent over unencrypted HTTP to port 8099 (The Hacker News). The beacon carries:

  • Public IP address
  • Hostname and local username
  • OS and CPU architecture
  • Home and working directories
  • Global Git email
  • Names, not values, of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP

(The Hacker News, Microsoft Security Blog)

No other follow-on payloads have been observed (The Hacker News).

Why many hosts were not remotely reachable. Enabling the local SSH service needs admin rights that the extension lacks on most macOS and Windows hosts. On those hosts the attacker could not have logged in through the tunnel, but the key, persistence and beacon still happen (The Hacker News). Phorion cautions that this is no defense if Remote Login is already on, or is enabled later (Help Net Security).

Cursor’s response. Cursor says it removed the version, shut down the marketplace, audited it and found no other tampered extensions, rotated its keys and rebuilt the marketplace. It also worked with the cloud provider to take the attacker server offline, which stopped the tunnel and the data reports (Help Net Security).

Reported timing. Sources differ slightly on how long the build was live: about 11 hours per Cursor as reported by Help Net Security and The Register, and close to 12 hours per Anthropic as reported by The Hacker News.

Am I affected?

You are potentially affected if all of these apply:

  • You use Cursor, or another editor that pulled the extension from the Cursor marketplace.
  • You installed or auto-updated anthropic.claude-code to 2.1.312 or 2.1.313 from that marketplace.
  • That happened on October 29, 2026, in the window above.

Auto-update was enough to be exposed (The Hacker News).

Users who installed Claude Code from Open VSX or the Microsoft Visual Studio Marketplace are not known to be affected (The Hacker News). The npm package is also not affected (Microsoft Security Blog).

Look for these artifacts:

  • Authorized key: an entry labeled svc-telemetry in authorized_keys.
  • macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt, ~/.config/.smtk.
  • Linux: an @reboot user-crontab entry, ~/.config/.smt, ~/.config/.smtk.
  • Windows: a scheduled task named SysMon, %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, or a Startup-folder sysmon.cmd.
  • Temporary key file: a hidden file named .stk_ followed by ten hex characters.
  • Network: connections to 134.209.82[.]225, including HTTP to port 8099.

(Microsoft Security Blog, GBHackers)

An artifact alone does not prove the startup mechanism ran successfully (Microsoft Security Blog).

What to do now

  1. Inventory. Find systems that installed or auto-updated anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace, using extension-installation records and endpoint, network and authentication telemetry (Microsoft Security Blog).
  2. Preserve evidence first. Keep the extension package, modified SSH authorization files, generated keys and scripts, and startup configuration before any cleanup (Microsoft Security Blog).
  3. Isolate hosts showing loader execution or backdoor installation. Cursor also advises considering a rebuild (Help Net Security).
  4. Remove the artifacts manually. Removing or updating the extension does not delete files written outside its install directory. Remove confirmed unauthorized SSH keys, tunnel identities, scripts and startup entries separately, and keep your legitimate SSH configuration (Microsoft Security Blog, GBHackers). Cursor has published check commands and cleanup scripts for macOS and Windows (Help Net Security). Those scripts are not linked here because their URL is not in the supplied sources.
  5. Check for attacker logins. Phorion suggests reviewing SSH logs for logins from localhost that used the svc-telemetry key (Help Net Security).
  6. Rotate credentials and revoke sessions that the machine could reach, working from a trusted system. Cursor notes that the limited data collection does not rule out later credential access through the backdoor (Help Net Security). Prioritize anything matching the names the beacon collected, such as cloud keys and API tokens.
  7. Hunt on the network. Search for traffic to 134.209.82[.]225, including HTTP to port 8099 and outbound SSH (GBHackers).
  8. Reduce future exposure. Approved-publisher restrictions and installation cooldowns can help in managed developer environments (GBHackers). Publisher names alone are not enough here, because the publisher was genuine. A researcher recommends watching extension behavior instead, since a coding extension planting SSH keys should be caught quickly (Help Net Security).

Not confirmed: how the attacker published under Anthropic’s extension ID on Cursor’s marketplace, what access they obtained, and whether any attacker ever logged in to a victim machine.

Sources