Trojanized Claude Code Extension Distributed Through Cursor Marketplace
Summary
A trojanized Claude Code 2.1.313 extension was available in Cursor’s marketplace on Oct. 29, 2026; up to 5,000 users may have installed it. Its loader collected host data, added an SSH key, installed persistence and attempted a reverse tunnel.
Key points
- Cursor said the malicious version 2.1.313 was available from approximately 2:27 a.m. to 1:35 p.m. PT on Oct. 29, 2026; up to 5,000 users may have installed it.
- A 66-line loader ran automatically when the extension loaded, added an adversary-controlled SSH key, installed OS-specific persistence, and attempted to establish a reverse SSH tunnel.
- The loader collected host and development-environment information, including usernames, hostnames, working directories, Git configuration, public IP addresses, and names of environment variables commonly associated with credentials and cloud services.
- Errors reportedly prevent key parts of the SSH backdoor from working on most Windows and macOS systems unless Cursor has administrator privileges. Reports did not indicate successful follow-on activity through the tunnel, and no actor was publicly identified.
- Cursor removed the package, temporarily took its marketplace offline, rotated keys, and reported no evidence that other extensions were tampered with. The article reports no evidence that the Microsoft Visual Studio Code Marketplace, Open VSX, or npm distributed a malicious version.
- Removing or updating the extension does not remove SSH keys or persistence already written to disk. The article recommends investigating affected systems, removing artifacts, blocking related infrastructure, rotating accessible credentials, and upgrading after remediation.
Article Details
- Attack Vectors
- A trojanized Claude Code extension version 2.1.313 was distributed through the Cursor marketplace on October 29, 2026, under Anthropic’s legitimate extension identifier.
- The injected loader executes automatically when the extension loads, without further user interaction.
- The loader added an adversary-controlled SSH key, attempted to enable SSH access and establish a reverse SSH tunnel, and installed platform-specific persistence. The SSH backdoor’s functionality was limited on most Windows and macOS systems unless Cursor ran with administrator privileges.
- Defensive Notes
- Identify systems that installed or updated Claude Code version 2.1.313 from the Cursor marketplace between approximately 2:27am and 1:35pm PT on October 29, 2026; use installation and update logs to scope affected hosts.
- Isolate affected systems and preserve forensic evidence. Review for the svc-telemetry SSH key, connections to 134.209.82[.]225 on ports 22 and 8099, scheduled tasks such as SysMon, the com.apple.sysmond LaunchAgent, and cron-based persistence.
- Remove identified SSH keys, persistence mechanisms, and tunnel processes; block communication with the published infrastructure and investigate connected systems.
- Rotate cloud credentials, access tokens, repository credentials, and API keys accessible from affected hosts. Upgrading or uninstalling the extension does not remove artifacts already written to disk.
- After remediation, upgrade affected installations to version 2.1.314 or later and monitor cloud environments, repositories, deployment systems, and administrative tooling for follow-on access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]209[.]82[.]225 | Published malicious infrastructure; the article advises investigating connections to this address on ports 22 and 8099. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe loader collected public IP addresses and other host information.T1033 · System Owner/User DiscoveryThe loader collected usernames from affected hosts.T1053.003 · CronThe loader installed cron-based persistence on Linux.T1053.005 · Scheduled TaskThe loader installed scheduled-task persistence on Windows; SysMon is cited as an example task name.T1082 · System Information DiscoveryThe loader collected operating-system details and host information.T1098.004 · SSH Authorized KeysThe loader added an adversary-controlled SSH key to authorized_keys on affected hosts.T1195.001 · Compromise Software Dependencies and Development ToolsA malicious build of the Claude Code extension was distributed through the Cursor marketplace under the legitimate extension identifier.T1543.001 · Launch AgentThe loader installed a com.apple.sysmond LaunchAgent for persistence on macOS.T1572 · Protocol TunnelingThe loader attempted to establish a reverse SSH tunnel and researchers observed recurring tunnel reconnection attempts.
Vendors
Products
Claude CodeA malicious version of the official Claude Code extension, version 2.1.313, was distributed through the Cursor marketplace on October 29, 2026.CursorA malicious version of the official Claude Code extension, version 2.1.313, was distributed through the Cursor marketplace on October 29, 2026.VSCodeClaude Code is Anthropic’s AI coding assistant for Visual Studio Code (VS Code) and compatible editors.