Cursor's Claude Code Extension Backdoor: What 5,000 Developers Need to Know About the October 2026 SSH Attack

On October 29, 2026, a trojanized version of Anthropic's Claude Code VS Code extension (version 2.1.313) was distributed via Cursor's marketplace, exposing up to 5,000 developers to an SSH backdoor attack. The malicious extension, active for approximately 11 hours, attempted to install persistent SSH keys and exfiltrate reconnaissance data from affected machines.

Trojanized Extension Discovered

The security compromise involved a maliciously modified build of the Claude Code VS Code extension, specifically version 2.1.313. This altered extension was made available through Cursor's marketplace, a platform for developers to access various VS Code extensions. The malicious build was active for a limited window on October 29, 2026, before being identified and removed.

Researchers at Phorion and OpenSourceMalware documented the compromise on October 30, providing details on the nature of the attack. It was confirmed that Cursor was the exclusive source distributing this malicious version. Other major marketplaces, including npm, Open VSX, and Microsoft's official VS Code Marketplace, continued to distribute only the legitimate version of the Claude Code extension during this period.

Impact on Developers

The primary concern for the estimated 5,000 affected developers was the malicious JavaScript loader embedded within the tampered extension. This loader attempted to install a persistent SSH backdoor on developer machines and was designed to exfiltrate reconnaissance data. While coding errors in the malware likely prevented the SSH tunnel from fully succeeding on most macOS and Windows hosts, the attacker's SSH keys were still added, and persistence mechanisms were installed.

This means that even if a full reverse tunnel was not established, the malicious code had already made changes to the affected systems, potentially leaving them vulnerable to further attacks or unauthorized access. The exfiltration of reconnaissance data also poses a risk, as it could provide attackers with valuable information about the compromised environments.

Cursor's Response and Remediation

Upon discovering the security incident, Cursor took immediate action. The company removed the malicious package from its marketplace and temporarily shut down its entire VS Code marketplace to address the vulnerability. As part of its remediation efforts, Cursor rotated its keys and rebuilt the marketplace to ensure the integrity of its distribution platform. Cursor also worked to take the command-and-control server associated with the attack offline.

For developers who may have been affected, Cursor and security researchers recommend several remediation steps:

• Check for the presence of the 'svc-telemetry' key on their systems.
• Isolate any potentially compromised hosts to prevent further spread or access.
• Remove any installed persistence mechanisms related to the malicious extension.
• Rotate all relevant credentials, including SSH keys and API tokens.
• Consider a complete rebuild of the affected development environment to ensure all traces of the malware are eliminated.

Conclusion

The distribution of a trojanized Claude Code extension through Cursor's marketplace on October 29, 2026, serves as a critical reminder of the supply chain risks inherent in software development tools. While Cursor responded swiftly to mitigate the threat, the incident highlights the ongoing need for developers to exercise vigilance when installing extensions and for marketplace operators to maintain robust security protocols. Developers should prioritize the recommended remediation steps to secure their environments and remain informed about latest AI news and security advisories.

Sources

• GitHub - HappyHackingSpace/claude-code-backdoor-check: Read-only scanner for the backdoored Claude Code 2.1.313 extension (Cursor marketplace, Oct 2026): SSH key, persistence, reverse tunnel. macOS + Linux. · GitHub
• GitHub - anomixer/openclaw-news: OpenClaw Daily News (with Ollama + Telegram Quick Setup Guide) | 每日新聞兼快速安裝指南 · GitHub
• Making frontier cybersecurity capabilities available to defenders \ Anthropic
• Security - Claude Code Docs
• Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace · Cursor