Backdoored Claude Code Build Hit Cursor Store

Cursor, the AI code editor, said on Thursday, Oct. 29, that attackers slipped a backdoored build of Anthropic's Claude Code extension into its own extension marketplace. The tampered versions, 2.1.312 and 2.1.313, were available from about 2:27 a.m. to 1:35 p.m. Pacific time that day, according to Cursor's security notice. Cursor said the builds "were not developed by Anthropic."

The malicious code tried to plant an attacker's SSH key and open a reverse tunnel into developers' machines. Cursor told The Hacker News that "at most 5,000 users" installed it.

Key takeaways

• Fake Claude Code builds 2.1.312 and 2.1.313 for Windows and macOS sat in Cursor's marketplace for about 11 hours on Oct. 29.
• The payload gathered host details and tried to add an SSH key labeled "svc-telemetry" plus a persistent reverse tunnel to 134.209.82.225.
• Cursor says uninstalling may not be enough and recommends removing the key, rotating credentials and considering a host rebuild.

How the Claude Code extension backdoor worked

Security firm OpenSourceMalware, which analyzed version 2.1.313, found a 66-line loader prepended to the extension's main file, extension.js. The code runs as soon as the extension loads. "The user doesn't need to begin a Claude conversation," the firm wrote in its analysis.

According to Cursor, the loader collected the hostname, username, operating system, CPU architecture, home and working directories, Git email, public IP address and the names of environment variables. OpenSourceMalware said it captured only variable names, not their values, for up to 40 variables matching patterns such as KEY, TOKEN and SECRET.

It then tried to add an Ed25519 SSH key, switch on the local SSH service and open a reverse SSH tunnel to the attacker's server. Cursor said that step "would generally fail" without admin rights. Persistence came through a macOS LaunchAgent named com.apple.sysmond.plist or a Windows scheduled task called SysMon, with scripts retrying about every 60 seconds. OpenSourceMalware also found a Linux crontab path in the code.

What Cursor and Anthropic did

Cursor said it pulled the malicious build, temporarily shut down its marketplace, rotated keys, rebuilt the marketplace and audited access, finding no other tampered extensions. It also worked with the hosting provider to take the attacker's server offline. Cursor has not explained how the package got into its marketplace.

OpenSourceMalware said the npm package @anthropic-ai/claude-code and the extension on Open VSX and Microsoft's VS Code Marketplace were not affected. The Hacker News reported that Anthropic published a clean version, 2.1.314, to Open VSX and Microsoft's marketplace on Oct. 30. The last legitimate release on Anthropic's GitHub page before the incident, 2.1.312, is dated Oct. 27, which means the attackers reused a real version number.

Context: auto-updates as an attack path

The attackers did not need a look-alike name. They shipped under the official extension ID, anthropic.claude-code, so users with automatic updates turned on could pick it up without doing anything. "Anyone who has their Claude Code instance set to auto-update could have consumed the malware," OpenSourceMalware co-founder Jenn Gile told The Hacker News.

Coding assistants run with a developer's own access to source code, cloud keys and internal servers, so a compromised plug-in reaches far beyond the editor. That makes the marketplace that serves the update as important as the vendor that writes it.

What's next

Cursor said it will contact affected users directly and has posted remediation scripts for macOS and Windows. "Uninstalling the extension may not be sufficient," its notice says. OpenSourceMalware went further: "Rebuilding the host is safer than assuming removal of known artifacts restores trust."

FAQ

Was I affected?

Only if you installed Claude Code 2.1.312 or 2.1.313 from Cursor's marketplace during the Oct. 29 window. Check ~/.ssh/authorized_keys for a key labeled svc-telemetry and look for connections to 134.209.82.225.

What should affected users do?

Isolate the machine, remove the key and persistence files, rotate every credential the account could reach from a clean device, and consider rebuilding the host, as Cursor and OpenSourceMalware advise.

Were VS Code users hit?

OpenSourceMalware and The Hacker News found no sign the malicious build reached Microsoft's VS Code Marketplace or Open VSX.

References

• Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace — Cursor (Oct. 29, 2026; updated Oct. 30)
• Trojanized Claude Code Extension Plants an SSH Backdoor — OpenSourceMalware (Oct. 30, 2026)
• Releases · anthropics/claude-code — GitHub
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor — The Hacker News (Oct. 30, 2026)