Trojanized Claude Code Extension Distributed on Cursor Marketplace With SSH Backdoor

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed via the Cursor Marketplace as a legitimate update. The incident involved malicious versions 2.1.312 and 2.1.313, which attempted to install a persistent SSH backdoor on affected developer systems.

According to disclosed details, the unauthorized update was published under Anthropic's legitimate extension identifier. Cursor temporarily shut down its marketplace following the discovery to remove the compromised package. Analysts noted that the malicious update was isolated to the Cursor IDE extension marketplace, with no evidence of impact on Microsoft's official VS Code Marketplace or the Open VSX registry.

How the Malicious Extension Operates

Security analysis revealed that the compromised package contained an inserted JavaScript loader designed to execute upon startup and webview activation:

• SSH Key Injection: Adds an attacker-controlled key labeled "svc-telemetry" to the user's `~/.ssh/authorized_keys` file.
• Reverse Tunneling: Attempts to establish a reverse SSH tunnel pointing to an external IP address (`134.209.82[.]225`).
• Persistence Mechanisms: Installs platform-specific persistence via scheduled tasks, crontab entries, or LaunchAgents depending on the operating system.
• Data Exfiltration: Transmits host reconnaissance data, including the home directory, current working directory, global Git email, and environment variable names containing terms like KEY, TOKEN, or SECRET, to an unencrypted HTTP endpoint.

Industry analysts noted that while turning on a local SSH service typically requires administrator rights—which the extension often lacked on macOS and Windows hosts—the backdoor still succeeded in writing unauthorized SSH keys, creating persistence artifacts, and exfiltrating reconnaissance data.

Impact and Response

Cursor reported that at most 5,000 users were affected during the window the malicious versions were live on October 29, 2026. Anthropic clarified that its own internal systems were not compromised and that the threat actor used external marketplace access to publish the tampered package.

In response, Cursor rotated its keys, rebuilt the marketplace, and disabled the attacker's server infrastructure. Microsoft and security firms have urged affected organizations to verify system logs, isolate impacted hosts, remove unauthorized SSH keys and persistence artifacts, and rotate exposed credentials.