Trojanized Claude Code Extension in Cursor Marketplace Attempted to Install SSH Backdoor
Summary
A trojanized Claude Code extension update distributed through Cursor's marketplace attempted to add an SSH key, establish persistence and beacon host data. Cursor reported up to 5,000 potentially affected users; the update was removed.
Key points
- Malicious version 2.1.313 was distributed under the legitimate anthropic.claude-code extension identity through Cursor's marketplace; the method used to introduce it is unknown.
- The extension attempted to add an attacker-controlled key to ~/.ssh/authorized_keys, establish a reverse SSH tunnel, install platform-specific persistence and send host reconnaissance data over unencrypted HTTP.
- Cursor said up to 5,000 users may have installed the update between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.
- Cursor said the malicious update was limited to its marketplace; there was no evidence it reached Open VSX or Microsoft's official VS Code Marketplace.
- The malicious version was removed, and Anthropic published version 2.1.314 to Open VSX and Microsoft's marketplace. No follow-on payloads had been observed.
- Users who installed the compromised version were advised to isolate affected hosts, remove the unauthorized SSH key and persistence, and rotate credentials and sessions.
Article Details
- Victim Organization
- Cursor
- Victim Domain
- cursor[.]com
- Incident Type
- Supply-chain compromise: a trojanized Claude Code extension was distributed through the Cursor Marketplace and attempted to install a persistent SSH backdoor.
- Incident Date
- 2026-10-29
- Data Types Exposed
- Host reconnaissance data
- Environment-variable names; the article says their values were not included in the initial beacon
- Affected Records
- At most 5,000 users installed the malicious version, according to Cursor; the number of affected records is not disclosed.
- Operational Impact
- Cursor temporarily shut down its marketplace to remove the compromised package. The extension added an attacker-controlled SSH key, installed persistence, attempted to establish SSH reachability through a reverse tunnel, and sent host details to the attacker. On most macOS and Windows hosts, enabling the local SSH service required administrator rights and reportedly failed; the extension could still add the key, install persistence, and send host details.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]209[.]82[.]225 | Attacker-controlled endpoint used for the reverse SSH tunnel and host-data beacon. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe extension sent host reconnaissance data to the attacker endpoint in a beacon.T1053.003 · CronThe extension installed persistence using a crontab on applicable systems.T1053.005 · Scheduled TaskThe extension installed persistence using a scheduled task on applicable systems.T1098.004 · SSH Authorized KeysThe extension added an attacker-controlled public key to the user's SSH authorized_keys file.T1543.001 · Launch AgentThe extension installed persistence using a LaunchAgent on applicable systems.T1572 · Protocol TunnelingThe extension attempted to establish a reverse tunnel to provide a pathway to the victim's SSH service.
People
Jenn GileCo-founder of OpenSourceMalware who described the malicious loader inserted into the extension and commented on its distribution.Paul McCartySecurity researcher who explained that environment-variable names in the beacon could reveal configured cloud providers, CI systems, and credential types.
Vendors
AnthropicCybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistentCursorthat a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.
Products
Claude CodeCybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistentCursorthat a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.VS Code"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users," Cursor said. "This malicious version of the