Apps & Software

Malicious Claude Code Extension on Cursor Plants Backdoors

A supply-chain compromise on Cursor's extension marketplace distributed a malicious version of Anthropic's Claude Code extension, exposing thousands of developers to potential system backdoors and reconnaissance data collection.

Radwan AbdulhadiEditor and technology writer

Published: October 31, 2026 · Updated: October 31, 2026 · 3 min read

Malicious Claude Code Extension on Cursor Plants Backdoors — Image: BleepingComputer

Supply-Chain Compromise on Cursor Marketplace

A maliciously modified version of Anthropic's Claude Code extension was distributed through the Cursor extension marketplace, exposing as many as 5,000 developers to persistent security threats over an 11-hour window on October 29. Detailed further in reports by BleepingComputer, the compromised package carried version number 2.1.313 and was active between 2:27 a.m. and 1:35 p.m. Pacific Time.

Cursor, an AI-powered code editor built from Microsoft's open-source Visual Studio Code (VS Code) with support for VS Code extensions, stated that Anthropic did not develop the malicious extension. However, neither Cursor nor Anthropic has fully explained how the attackers managed to distribute the compromised package using Anthropic's official account.

Attack chain Source: OpenSourceMalware · Source: BleepingComputer

Malware Mechanics and Backdoor Deployment

Security researchers analyzing the incident found that attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file while leaving the legitimate extension code intact. According to findings published by Phorion, the malicious code executes immediately upon loading without requiring any direct user interaction with Claude Code.

Once installed, the malicious script collects local system and user details, including Git email addresses, public IP addresses, and the names of environment variables associated with sensitive credentials. It subsequently attempts to add an attacker-controlled SSH key, enable local SSH services, and establish a persistent reverse tunnel that retries roughly every minute.

Coding Errors Limit Remote Access Impact

Despite the aggressive behavior of the extension, analytical insights from OpenSourceMalware indicate that coding errors in the malware's SSH setup routines likely prevented attackers from gaining full remote access to many compromised Windows and macOS machines.

On macOS, the malware attempted to check remote login status without elevated privileges, producing an administrator-access error and skipping activation entirely. On Windows, it tried to launch the OpenSSH server via a Unix shell not present on standard Windows environments. Even though the remote tunnels frequently failed to provide remote access where SSH was not already running, the malware successfully transmitted reconnaissance data to an external server.

Anthropic VS code extension on Cursor backdoored for nearly 12 hours — Image related to the report from Ars Technica · Source: Ars Technica

Response and Remediation Efforts

Following the discovery of the incident, Cursor removed the malicious extension and temporarily shut down its marketplace to audit other extensions and rotate access keys. The company also collaborated with the hosting provider to take the attacker's server offline, neutralizing the reverse connections and halting data transmission.

Developers who downloaded the affected package during the exposure window are advised to check their machines for an 'svc-telemetry' SSH key and apply recommended remediation steps, such as isolating impacted environments, rotating credentials, invalidating active sessions, and rebuilding from secure backups.

Sources

BleepingComputerMalicious Claude Code extension on Cursor planted SSH backdoors
Ars TechnicaAnthropic VS code extension on Cursor backdoored for nearly 12 hours