Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Trojanized Claude Code Extension Hit Cursor Users With an SSH Backdoor

A tampered build of Anthropic's official Claude Code extension was served through the Cursor marketplace under the legitimate publisher identity. Version 2.1.313 planted an attacker SSH key, set up persistence and beaconed host details. Up to 5,000 users were exposed.

4T4Tify Team4Tify
Oct 30, 2026·6 min read
Trojanized Claude Code Extension Hit Cursor Users With an SSH Backdoor

Trojanized Claude Code Extension Slipped Into the Cursor Marketplace With an SSH Backdoor

A tampered build of Anthropic's official Claude Code extension for VS Code was served to Cursor IDE users as a routine update on 29 October 2026. The build carried the legitimate extension identifier and publisher name, which is exactly why it got through: for anyone with auto-update enabled, nothing looked wrong.

What happened

The malicious release was labelled version 2.1.313 and was available only through the Cursor extension marketplace. Cursor says at most 5,000 users installed it during a window of roughly eleven hours on 29 October, after which the package was pulled and the marketplace was temporarily taken offline for clean-up. Cursor is contacting affected users directly.

There is no evidence that the bad build reached Open VSX or Microsoft's VS Code Marketplace. Users who installed Claude Code from either of those sources are not known to be affected. Anthropic has since shipped version 2.1.314 to both official registries.

How the attackers managed to publish under the legitimate identity has not been explained yet. Cursor's statement stresses that the build was not developed by Anthropic, but that is cold comfort: the whole problem is that it was indistinguishable from the real thing at install time.

What the tampered build does

A short loader was prepended to the extension's main JavaScript bundle. It runs quietly when the extension activates, suppresses its own errors, and then lets the genuine extension load so the user notices nothing.

Its goals are straightforward and nasty:

  • Backdoor access. It plants an attacker-controlled public key in the user's SSH authorized keys file, disguised with a label that reads like a benign telemetry service account.
  • Remote reachability. It tries to enable the local SSH service and open an outbound tunnel to attacker infrastructure, so the operator can reach the machine even behind NAT.
  • Persistence. It installs a platform-specific startup mechanism on Windows, Linux and macOS so the tunnel comes back after reboot.
  • Reconnaissance. It sends a profile of the host over plain HTTP: public IP, hostname, local username, OS and CPU, working directories, the global Git email, and the names of up to 40 environment variables that look like credentials (KEY, TOKEN, SECRET, PASS, AWS, GCP).

Environment-variable values are not included in that first beacon. The names alone, however, tell an attacker which cloud providers, CI systems and credential types are configured on the box, and a working SSH session would let them read everything anyway.

On most macOS and Windows machines the step that turns on the SSH service needs administrator rights the extension does not have, so the interactive login path fails there. The key, the persistence and the host profile are still dropped regardless. No second-stage payload has been observed so far.

Why it matters

Developer workstations are the softest, richest target in most organisations. They hold cloud credentials, signing keys, source code and SSH access to production. An IDE extension runs with the full rights of the developer, and marketplaces are trusted implicitly. A poisoned update to a tool with tens of millions of downloads is about as efficient a delivery mechanism as an attacker can hope for.

The incident also lands days after another supply-chain hit on a developer tool, where already-published release binaries of a popular cloud CLI were silently swapped for a credential stealer. The pattern is clear: attackers are going after the plumbing developers trust rather than the applications they build.

What to do

If you use Cursor and had Claude Code installed on 29 October 2026, treat the machine as compromised until proven otherwise:

  1. Check the installed version. Anything reporting 2.1.313 is malicious. Upgrade to 2.1.314 or later from an official source.
  2. Inspect SSH authorized keys for every user on the host and remove any entry you did not add, especially one with a telemetry-style comment.
  3. Hunt for persistence: unexpected scheduled tasks on Windows, new cron entries on Linux, and unfamiliar LaunchAgents on macOS. Remove any outbound SSH tunnel they spawn.
  4. Rotate secrets that were reachable from that workstation: cloud keys, API tokens, Git credentials, session cookies and anything referenced in environment variables.
  5. Review outbound connections from the affected host during the exposure window and look for unexpected SSH or HTTP traffic to unfamiliar servers.
  6. Reconsider auto-update for IDE extensions on machines with access to production systems, or pin versions and review changes before applying them.

Credentials harvested from developer machines rarely stay private. They are traded, bundled and resold, often weeks after the initial intrusion. 4tify's Deep/Dark Web monitoring service watches for exactly this kind of leaked developer identity and access material, so that an exposed token or Git email surfaces as an alert for your team rather than as a surprise in someone else's hands.

SHARE