Trojanized Claude Code extension targets Cursor users with SSH backdoor

On October 29, 2026, cybersecurity researchers identified a trojanized version of Anthropic’s official Claude Code extension distributed through the Cursor IDE marketplace. The malicious update, masquerading as legitimate version 2.1.313, attempted to install a persistent SSH backdoor on affected systems before Cursor shut down its marketplace to contain the breach.

What happened

Attackers injected a malicious loader into the main JavaScript bundle of the Claude Code extension, distributing it under Anthropic’s legitimate publisher identity and extension ID. This supply chain attack targeted users of the Cursor IDE specifically, with no evidence suggesting the compromised package reached Microsoft’s VS Code Marketplace or Open VSX. Cursor confirmed that at most 5,000 users were impacted during the brief window the malicious version was available.

The incident occurred between approximately 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. Once detected, Cursor temporarily suspended its marketplace to remove the compromised package and began notifying affected users directly. Anthropic subsequently released version 2.1.314 to official channels to replace the tainted build. The exact method attackers used to inject the code into the legitimate extension pipeline remains unclear, raising concerns about the security of third-party distribution channels for developer tools.

Jenn Gile, co-founder of OpenSourceMalware, noted that the package identified itself as the authentic anthropic.claude-code extension but contained a 66-line malicious loader inserted before the legitimate code. This technique allows the malware to execute its payload while still running the expected functionality, making detection more difficult for users who do not inspect the underlying code structure.

How it works

The malicious extension activates upon VS Code startup and when its webview opens. It immediately attempts to add an attacker-controlled SSH key to the user’s ~/.ssh/authorized_keys file, labeling it "svc-telemetry" to blend in with legitimate service accounts. The malware then tries to enable the local SSH service and establish a reverse tunnel to the command-and-control server at 134.209.82[.]225.

To ensure persistence, the malware installs platform-specific mechanisms: scheduled tasks on Windows, crontab entries on Linux, and LaunchAgents on macOS. It also sends reconnaissance data to the attacker’s server over unencrypted HTTP on port 8099. While enabling SSH requires admin rights which may fail on many macOS and Windows hosts, the malware still succeeds in adding the SSH key and establishing persistence regardless of privilege level.

The beacon transmits sensitive host information, including the public IP address, hostname, operating system, and CPU architecture. Crucially, it exfiltrates the names of up to 40 environment variables containing keywords like KEY, TOKEN, SECRET, PASS, AWS, or GCP. Although the values are not sent in the initial beacon, the variable names reveal the presence of cloud credentials and CI system configurations, providing a roadmap for further exploitation if SSH access is achieved.

Key details

• Affected version: Only version 2.1.313 distributed via the Cursor Marketplace was compromised; versions on Microsoft VS Code Marketplace and Open VSX were unaffected.
• Impact scope: At most 5,000 users installed the malicious update between 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.
• Persistence mechanism: The malware uses scheduled tasks, crontabs, and LaunchAgents to maintain access across reboots on Windows, Linux, and macOS.
• Data exfiltration: Sends host reconnaissance data and environment variable names to 134.209.82[.]225:8099 over unencrypted HTTP.
• SSH backdoor: Attempts to add an attacker-controlled key labeled "svc-telemetry" to ~/.ssh/authorized_keys and establish a reverse tunnel.
• Remediation: Anthropic has released clean version 2.1.314; Cursor is contacting impacted users directly.

Why it matters

This incident highlights the risks inherent in relying on third-party marketplaces for critical developer tools. Even when the original software vendor is reputable, the distribution channel can become a single point of failure. For engineering teams, this underscores the need for rigorous supply chain security practices, including verifying checksums and monitoring for unexpected updates in automated pipelines. The fact that the malware mimicked a legitimate update ID makes it particularly dangerous for users with auto-update enabled.

The theft of environment variable names is a significant threat vector for modern cloud-native development. While the attackers did not immediately steal credential values, knowing which secrets exist in a developer’s environment allows for targeted phishing or further exploitation if the SSH backdoor succeeds. For technical leads, this serves as a reminder to enforce least-privilege principles and regularly rotate credentials, especially those stored in local environment variables.

What you can do

• Check your installation: Verify if you installed Claude Code version 2.1.313 from the Cursor Marketplace between 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.
• Isolate affected hosts: If you suspect infection, disconnect the machine from the network to prevent further data exfiltration or remote access.
• Remove malicious artifacts: Delete the unauthorized SSH key labeled "svc-telemetry" from ~/.ssh/authorized_keys and remove any unknown scheduled tasks, crontabs, or LaunchAgents.
• Rotate credentials: Immediately rotate all API keys, tokens, and secrets stored in environment variables, especially those related to AWS, GCP, or CI systems.
• Update to safe version: Install Anthropic’s clean version 2.1.314 from the Microsoft VS Code Marketplace or Open VSX instead of the Cursor Marketplace.
• Monitor for anomalies: Review network logs for outbound connections to 134.209.82[.]225 and monitor SSH logs for unauthorized login attempts.