Understand this story
On October 29, 2026, Cursor reported that a maliciously tampered version of Anthropic.claude-code 2.1.313 had appeared in its extension marketplace. This version was not developed by Anthropic and affected at most 5,000 users. Cursor stated that the malicious code collects host and user information, attempts to write the attacker's SSH public key, and establishes a reverse SSH tunnel; however, due to permission restrictions, this step fails on most macOS and Windows hosts. Cursor has removed the version, rebuilt the marketplace, and shut down the attacker's servers, while also providing a command to detect the svc-telemetry public key and cleanup scripts for macOS and Windows. The next day, Phorion disclosed that extension 2.1.313 had been implanted with a persistent SSH backdoor, and stated that Cursor had withdrawn the version from NPM and the VSCode registry; Phorion also pointed out a flaw in the Remote Login status check on macOS, which skips the enabling step on machines where SSH is not enabled, but the key and persistence still take effect.
AI-generated from public reports
Latest development · Report
Backdoor implanted in official Claude Code for VS Code extension on Cursor MarketplaceDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 30
Solidot
Backdoor implanted in official Claude Code for VS Code extension on Cursor Marketplace
Security researchers discovered a backdoor in the official Claude Code for VS Code extension on Cursor Marketplace. The affected version is Anthropic.claude-code 2.1.313, which was online for about 11 hours and is estimated to have affected about 5,000 users. The malicious extension collects information such as hostname, username, operating system, environment variables, Git email, and public IP; attempts to add attacker-controlled SSH keys to authorized_keys, enable the local SSH service, and establish a reverse SSH tunnel; and also uses a LaunchAgent or scheduled task to keep the tunnel active long-term, retrying about once every 60 seconds. Due to a bug in the malicious code, the SSH key implantation step will fail unless Cursor is launched with administrator privileges. This version has been taken down, Cursor has published a security advisory, and Anthropic has not yet made a statement; users who installed or updated to this version between 2:27 AM and 1:35 PM Pacific Time on October 29, 2026 need to check their systems.
SolidotRelated discussion
Solidot joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
heise online
Claude Code extension in the Cursor marketplace was implanted with an SSH backdoor
The official extension Claude Code for VS Code in the Cursor plugin marketplace was implanted with an SSH backdoor. The affected version 2.1.313 was online from 10:27 to 21:35 Central European Time on Thursday, and according to Reuters, up to 5,000 users were affected. Cursor stated that this version did not come from Anthropic and has provided a fixed version; administrators should upgrade to at least Claude Code for VSCode 2.1.314. Security firm Phorion analyzed that, due to a logic error, the backdoor usually cannot enable SSH on macOS, but it still writes SSH keys, achieves persistence, and sends machine information to the attacker; uninstalling the extension alone is not enough to remove it, and it is necessary to terminate the tunnel process and delete residual files such as LaunchAgents, cron, scheduled tasks, and ~/.config/.smt.
Unite.AI
Cursor Discloses Malicious Claude Code Extension in Marketplace Attempting to Plant SSH Backdoor
On October 29, 2026, Cursor disclosed that a maliciously tampered version 2.1.313 of the Anthropic.claude-code extension appeared in its VS Code extension Marketplace. The package was not developed by Anthropic and attempts to install a persistent SSH backdoor, affecting up to 5,000 users. This version was downloadable on that day from approximately 2:27 to 13:35 (Pacific Time). It collects host and user information, writes the attacker's SSH public key into authorized_keys, and establishes a reverse tunnel, while also achieving persistence through a LaunchAgent or scheduled task. Cursor has removed the version, shut down and rebuilt the Marketplace, and published indicators including hashes and IP 134.209.82.225, as well as cleanup scripts for macOS and Windows.
Hacker News TrendingSelected
Phorion Discloses That Claude Code VS Code Extension 2.1.313 Was Planted With an SSH Backdoor
Phorion claims that it found a backdoor in the official Claude Code for VS Code extension 2.1.313 on the Cursor Marketplace, which plants a persistent SSH backdoor on macOS, Linux, and Windows; Cursor has delisted this version and removed 2.1.313 from the NPM and VSCode registries. The malicious code is injected into extension.js in the form of an IIFE, executes upon loading, appends the svc-telemetry public key to ~/.ssh/authorized_keys, and establishes a reverse tunnel to 134.209.82.225. Phorion points out that the Remote Login status check on macOS is flawed: on machines where SSH is not enabled, it skips the enabling step, but the key and persistence still take effect, and it recommends checking the relevant files and processes.
Oct 29
Cursor BlogFirst-partySelected
Malicious version of Anthropic.claude-code 2.1.313 appears in the Cursor plugin marketplace; official security advisory released
Cursor discovered a maliciously tampered version of Anthropic.claude-code 2.1.313 in the VS Code extension marketplace. This version was not developed by Anthropic and affects at most 5,000 users. The malicious code collects host and user information, attempts to write the attacker's SSH public key and establish a reverse SSH tunnel, but due to permission restrictions this step fails on most macOS and Windows hosts. Cursor has removed the version, rebuilt the marketplace and shut down the attacker's server, and also provided a command to detect the svc-telemetry public key along with cleanup scripts for macOS and Windows.
Heat trend for this story
- Current
- 5
- Period peak
- 39 Oct 30 23:00
- 24-hour change
- -72%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.