A tampered Claude Code extension planted an SSH backdoor on developer machines through the extension marketplace of the Cursor code editor on October 29, 2026. The affected package was version 2.1.313 of Anthropic.claude-code, which according to Cursor was not built by Anthropic. It was available for download for about eleven hours, and Cursor says at most 5,000 users were affected. Cursor removed the version, temporarily shut down its marketplace and rebuilt it. The incident is still serious: anyone who installed the version will not get rid of the backdoor simply by uninstalling the extension.
The case is the latest in a series of supply chain attacks on developer tooling. Here is what Cursor has confirmed, what security researchers found in the malicious code, and how affected users can check whether their machine has been compromised.
Key Takeaways
- The tampered version 2.1.313 of the Claude Code extension was available in the Cursor marketplace on October 29 between about 09:27 and 20:35 UTC.
- The malicious code collects system information, adds a foreign SSH key labeled “svc-telemetry” to
authorized_keys, tries to open a reverse SSH tunnel and sets up persistence. - According to Cursor, enabling the local SSH service failed on most macOS and Windows machines because the extension lacked administrator rights and the code contained bugs. The key, the persistence and the data reporting still worked.
- Cursor says the attacker’s server is now offline. So far there is no evidence that other versions or other extensions are affected.
- Affected users should look for the key, use Cursor’s remediation scripts and rotate any reachable credentials from a clean system.
Claude Code extension 2.1.313: what happened in the Cursor marketplace
Cursor disclosed the incident in a security notice. A maliciously modified build of the Claude Code extension was available through Cursor’s VS Code extension marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time, which corresponds to 09:27 to 20:35 UTC on October 29. Cursor stresses that this version was not developed by Anthropic and says it will contact affected users directly.
According to its own account, Cursor removed the version immediately after detection and blocked further distribution. Out of caution, it then shut down the entire marketplace. The company audited access, says it found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. Together with the cloud provider that hosted the attacker’s server, it took that server offline. Cursor says the reverse tunnel and the data reporting therefore no longer work.
How the tampered version got into the marketplace in the first place remains unclear. Cursor names neither the entry point nor a suspect. The Open VSX registry now lists version 2.1.314 as the current release, published at 01:07 UTC on October 30. Version 2.1.313 can no longer be retrieved there.
What the malicious code does on the machine
According to Cursor, the extension tries to install a persistent SSH backdoor. It collects the hostname, username, operating system, architecture, home directory, working directories, the configured Git email address, the public IP address and the names of environment variables. It then appends an attacker-controlled public SSH key to the authorized_keys file, tries to enable the local SSH service and opens a reverse SSH tunnel to an external server.
To survive a reboot, the code installs a LaunchAgent on macOS and, on Windows, a scheduled task that tries to run as SYSTEM, with a Startup script as a fallback. Background scripts retry the tunnel roughly every 60 seconds. The extension reports the collected data and the status of the backdoor via HTTP to an attacker endpoint.
Security firm Phorion took the code apart in a detailed analysis. The malicious code was prepended as a function to the bundled extension.js file. It runs as soon as the editor loads the file, before the extension is regularly activated, so users did not have to click anything. For environment variables, Phorion says the code only collected names, not values, and specifically those that point to keys, tokens, passwords or cloud credentials. Phorion also found code for Linux that uses a cron job for persistence.
Why the backdoor often failed
There is some good news. To turn on the local SSH service, the extension needs administrator rights, which it does not have on most macOS and Windows machines. According to Cursor, that step therefore failed except in the unusual case where Cursor had been started with administrator privileges. Phorion also describes a bug on macOS: the code checks the Remote Login status without privileges, receives an error message instead of “Off” and skips the enablement attempt entirely. On Windows, Phorion says the code runs a PowerShell command through a helper function that hardcodes /bin/sh.
Nobody should rely on that. Anyone who already had SSH Remote Login enabled, or turns it on later, gives the attackers an open door as long as the foreign key is in place. And even when the SSH start failed, the extension still stored the key, installed persistence and sent system data. Cursor explicitly notes that the limited collection of environment variables does not rule out later credential access through the backdoor.
How developers can check whether they are affected
The incident matters for anyone who installed or updated Anthropic.claude-code 2.1.313 from the Cursor marketplace during the window on October 29. For other versions and the official distribution, Cursor says it has no evidence of tampering. The quickest test is a search for the key comment “svc-telemetry”:
- macOS and Linux:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "key found" - Windows: search
%USERPROFILE%\.ssh\authorized_keysandC:\ProgramData\ssh\administrators_authorized_keysfor “svc-telemetry”. Cursor provides a PowerShell command for this. - Installed version: check Cursor’s extension view or the extensions folder for a directory named
anthropic.claude-code-2.1.313.
Phorion recommends also searching for the key fingerprint, because the code only checks the comment. Further traces listed by Cursor are the files ~/.config/.smt and ~/.config/.smtk, temporary files with the prefix .stk_, the LaunchAgent com.apple.sysmond.plist on macOS and, on Windows, the scheduled task “SysMon” or a Startup script sysmon.cmd. On the network, look for SSH connections and HTTP requests on port 8099 to the IP address 134.209.82.225.
What affected users should do now
Cursor recommends a five-step process: check whether you are affected, search endpoint, network and extension installation telemetry for the indicators, isolate hosts that show signs of compromise, remove the key, persistence and tunnel processes with the provided scripts, and finally rotate all credentials and sessions reachable from that machine, from a trusted system. The macOS script runs as the affected user, not as root, and the Windows script in a PowerShell session with administrator rights.
One forensic detail matters: because logins through the tunnel arrive locally, Phorion says they show up in SSH logs as connections from 127.0.0.1 or ::1 using the “svc-telemetry” key. Anyone who finds such entries should assume actual access took place. Only after cleanup should affected users switch to a current, clean version of the extension.
Analysis: editor extensions as an entry point
The case shows how much trust developers place in extensions. An extension runs with the rights of the editor and therefore of the user. It can reach source code, SSH keys, Git configuration and local tools. What makes this incident especially sensitive is that a well-known, widely used package was distributed under its regular name and a plausible version number. With automatic updates enabled, users received it without doing anything.
Similar patterns have recently appeared in package registries: in the LiteLLM supply chain attack via PyPI and Docker and in the 14 npm packages that used dependency confusion to probe build environments. The Polymarket hack via a third-party script on the same day follows the same principle of getting in through a trusted vendor. For teams, this means extensions belong in the software inventory, versions should be pinned in sensitive environments, and writes by editor processes to ~/.ssh are a red flag that endpoint tools should report.
Conclusion
The tampered Claude Code extension was online for only a few hours, and coding errors limited its impact on many machines. That is no reason to relax. Affected systems carry a foreign key and persistence entries that survive an uninstall. Anyone using Cursor with the Claude Code extension should run the check, which takes seconds, and if it finds something, clean up thoroughly and rotate credentials. It is still unclear how the attackers managed to get the version into the marketplace.
