Malware · Application Security
Malicious Claude Code extension on Cursor tried to plant SSH backdoors
A fake Claude Code extension on Cursor's marketplace exposed up to 5,000 developers to malware that tried to install SSH backdoors. Coding errors limited the attack's impact, but users are urged to check for compromise.
Ross Grant3 min read
The short version
A fake version of a popular coding assistant extension was uploaded to the Cursor extension marketplace. Up to 5,000 developers may have installed it before it was removed. The extension tried to let attackers remotely access computers by planting SSH backdoors, but mistakes in the code meant this often failed. Still, some personal and system information was sent to the attackers, so anyone affected should check their computers and change passwords.
By the numbers
- 5,000developers potentially exposed to the malicious extensionBleepingComputer
- 11 hoursduration the malicious extension was availableBleepingComputer
What happened?
A malicious version of Anthropic's Claude Code extension was distributed through Cursor's extension marketplace for about 11 hours on 29 October 2026. Up to 5,000 developers were exposed to malware that tried to install SSH backdoors. Coding errors in the malware limited the attack's success, but affected users are urged to check for compromise. Only Cursor's marketplace was affected, not npm or Microsoft's VS Code Marketplace.
Who is affected
Up to 5,000 developers may have installed a malicious version of Anthropic's Claude Code extension for Cursor, an AI-powered code editor based on Visual Studio Code (VS Code). The compromised extension (version 2.1.313) was available on Cursor's extension marketplace for about 11 hours, from 2:27 a.m. to 1:35 p.m. Pacific Time on 29 October 2026. Cursor has said that only its own marketplace was affected, not npm, Open VSX, or Microsoft's Visual Studio Code Marketplace. There is no evidence that other versions or the official distribution were compromised. BleepingComputer (opens in a new tab)
How the attack worked
The malicious extension executed its payload as soon as it loaded, without any user interaction. Once installed, it collected system and user information, including the Git email and public IP address. It then tried to add an attacker-controlled SSH key, enable SSH access, and set up a reverse tunnel to an external server. Persistence was established through a macOS LaunchAgent or a Windows scheduled task or startup script, causing the malware to retry the tunnel roughly every minute. The extension sent host details and backdoor status to the attacker's server at 134.209.82[.]225.
However, researchers at Phorion found that coding mistakes in the malware's SSH setup routines prevented attackers from gaining remote access on many Windows and macOS systems. On macOS, the script failed to enable SSH due to lack of admin privileges. On Windows, it tried to use a Unix shell that does not exist by default, causing the SSH setup to fail. The malware could still install SSH keys and attempt persistence, but if SSH was not already active, the backdoor would not work. Despite this, the malware still sent reconnaissance data (usernames, hostnames, IPs, Git emails, and some environment variable names) to the attacker's server. The script did not directly steal credentials, suggesting attackers intended to access sensitive data manually if the SSH tunnel succeeded.
The response
Cursor removed the malicious extension and temporarily shut down its entire extension marketplace for a security audit and key rotation. The company worked with the hosting provider to take down the attacker's server, disrupting both the SSH connections and data exfiltration. Cursor's investigation found no evidence that other extensions or official versions were affected. Developers who downloaded the extension during the exposure window are advised to check for an 'svc-telemetry' SSH key on their systems and follow Cursor's remediation steps if found. Impacted machines should be isolated, secrets rotated, sessions invalidated, and environments rebuilt from clean backups.
What you should do
If you installed the Claude Code extension from Cursor's marketplace between 2:27 a.m. and 1:35 p.m. PT on 29 October, check your system for the 'svc-telemetry' SSH key. Follow Cursor's published remediation instructions if you find signs of compromise. Even if the backdoor failed, your system details may have been sent to the attacker. Rotate any potentially exposed credentials and restore from known-good backups if necessary.
So far, only BleepingComputer has reported this incident. It is unclear how attackers were able to publish a malicious extension under Anthropic's name, and whether any internal systems at Cursor or Anthropic were compromised. Both companies have been contacted for comment, but have not yet responded. BleepingComputer (opens in a new tab)
Why it matters
This incident shows how quickly a malicious extension can reach thousands of developers through a trusted marketplace. Even when malware fails to fully work, it can still leak sensitive information. Supply chain attacks like this are a growing risk for anyone who relies on third-party code or tools.
Key points
- Malicious Claude Code extension exposed up to 5,000 developers to malware.
- The malware tried to install SSH backdoors but failed on many systems due to coding errors.
- Cursor's marketplace was the only source affected; official versions were not compromised.
- Some system and user data was still sent to attackers even if the backdoor failed.
- Developers should check for the 'svc-telemetry' SSH key and follow remediation steps if affected.
Sources
BleepingComputer
Reference