A malicious Claude Code extension hit up to 5,000 developers via Cursor's marketplace, installing SSH backdoors and stealing host data.
Security researchers have disclosed that a tampered version of Anthropic's official Claude Code extension was distributed as a legitimate update, attempting to install a long-term SSH backdoor on developers' computers. Researchers at the macOS security firm Phorion and the group OpenSourceMalware analysed the malicious package, version 2.1.313, which was available for roughly 11 hours on October 29, 2026, before being pulled. Cursor, the company that runs the affected marketplace, and both research teams have published details and remediation guidance.
Attackers published a modified build of Anthropic's Claude Code extension under the extension's legitimate identity, anthropic.claude-code, using the version number 2.1.313. Because it arrived as a normal-looking update, anyone with auto-update enabled could have received it without realising.
According to Cursor, the malicious version was live in its VS Code extension marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026, affecting at most 5,000 users. The company says Anthropic did not develop the malicious extension and has not explained how attackers managed to publish the compromised package under Anthropic's name.
There is an important disagreement between the sources on where the compromise occurred. Help Net Security initially reported the bad package appeared on Open VSX, an open-source extension marketplace run by the Eclipse Foundation. However, The Hacker News published a correction stating the incident was traced to a compromise of the Cursor VS Code Marketplace, not Open VSX, and BleepingComputer also attributes the distribution to Cursor's marketplace. Both The Hacker News and Cursor say there is no evidence the malware reached Open VSX or Microsoft's official Visual Studio Marketplace.
As of October 30, 2026, the malicious version was removed, and Anthropic published a clean version, 2.1.314, to both Open VSX and the Microsoft VS Code Marketplace.
The incident affects developers who installed or auto-updated to Claude Code extension version 2.1.313 through Cursor's marketplace during the roughly 11-hour window. Cursor is an AI-powered code editor built on Microsoft's open-source VS Code, and the Claude Code extension adds Anthropic's AI coding assistant to compatible editors.
Cursor states the incident does not affect other extensions downloaded from its marketplace, nor its Grok Bot, Grok, or other SpaceXSI products. Users who installed Claude Code from Open VSX or Microsoft's Visual Studio Marketplace are not known to be affected. The malware targets Windows, Linux, and macOS, with platform-specific behaviour on each. No specific industry sectors or geographic regions are named in the sources.
The attackers did not build a fake extension from scratch. Instead they inserted a short malicious loader — described by OpenSourceMalware as a 66-line block of JavaScript — at the start of the extension's main bundle (extension.js), leaving the genuine extension code otherwise intact. An "immediately invoked function expression" simply means code that runs the moment the file loads, rather than waiting for the user to click anything.
Phorion's CEO Calum Hall explained that the injected code runs before the extension's normal startup routine, so the user does not need to interact with Claude Code for it to fire. Once active, the malware carries out several steps:
svc-telemetry to look harmless.Crucially, the backdoor only grants interactive access if the machine's SSH service is actually running. Phorion found the malware contained bugs that often prevented SSH from being switched on. On macOS, it checks whether Remote Login is enabled without administrator rights; the command returns an error instead of a status, so the malware skips the step that would enable SSH. On Windows, it tries to start the OpenSSH server through /bin/sh, a Unix shell not present on standard Windows installs, so that step fails too. Enabling SSH requires admin rights the extension lacks on most Mac and Windows hosts.
The sources agree this is a significant supply-chain threat even though the backdoor's bugs limited its reach. Where SSH was already running, or if a user later enables it, the backdoor is ready to use. Even when the tunnel fails, the malware still installs persistence, plants its key, and sends host details to the attacker — so affected machines are not clean simply because remote login failed.
Cursor says that on hosts where enabling SSH failed, the attacker could not have logged in through the tunnel, and that it worked with the cloud provider hosting the attacker's server to take it offline, which stopped both the tunnel and the data reports. Researchers stress the goal was long-term interactive access; Hall called it "a significant threat that installs persistence and beacons host reconnaissance." No follow-on payloads have been observed, according to The Hacker News. There is no CVE identifier in the source material. The sources note this follows an unrelated supply-chain attack on OVHcloud's official CLI about a week earlier.
For developers and administrators:
svc-telemetry and remove it.For everyday users: review which extensions you have installed, be cautious with auto-update on development tools, and apply remediation regardless of operating system, since data was still sent even where the backdoor failed.
The biggest open question is how attackers managed to publish a trojanized package under Anthropic's legitimate publisher identity; Cursor and The Hacker News both say the method remains unclear. It is also unknown exactly how many of the up to 5,000 affected users had SSH already running, and therefore how many were genuinely exposed to remote access. The sources do not identify who was behind the attack.
ITVedas analysis: This incident shows how trusted developer tooling is an attractive target, because a single poisoned update can quietly reach thousands of machines before detection. The sloppy SSH bugs limited the damage this time, but the persistence and reconnaissance alone are reason enough to treat any affected host as compromised.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →