Malicious Claude Code Extension Distributed Via Cursor Marketplace for 11 Hours, Installing SSH Backdoors

A maliciously modified version of Anthropic's Claude Code VS Code extension was available on Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. The compromised extension, version 2.1.313, was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time before Cursor removed it and temporarily shut down its marketplace for auditing [1].

What happened

Cursor, an AI-powered code editor built on Microsoft's open-source Visual Studio Code, operates its own mirror of the Open VSX extension registry used by VS Code forks, according to commenters on Hacker News [2]. On October 29, a tampered build of the official anthropic.claude-code package appeared on that mirror. Cursor's security notice states Anthropic did not develop the malicious version [1].

Independent analysis by CellCog and security researcher Paul McCarty revealed 66 lines of malicious JavaScript injected at the start of the extension's extension.js file [3]. Researchers at Phorion and OpenSourceMalware separately found that the attackers inserted a malicious JavaScript loader at the beginning of the same file, leaving the legitimate extension code otherwise unchanged [1]. The malicious code executed automatically when the extension loaded, without requiring any user interaction with Claude Code [1].

According to Hacker News commenters, the same version number (2.1.313) is absent from Microsoft's official Visual Studio Code Marketplace and from Anthropic's GitHub repository — there is no release tag for 2.1.313, while tags for 2.1.312 and 2.1.314 exist [2]. Initial reports suggested npm, Open VSX, and Microsoft's marketplace were also affected; later confirmation indicated Cursor's mirror was the only distribution point [1].

Malware behavior and its failures

When installed, the malicious extension:

Collected system and user information: username, hostname, public IP, Git email, and names of environment variables associated with sensitive credentials.
Added an attacker-controlled SSH public key labeled svc-telemetry to the user's authorized_keys file.
Attempted to enable the local SSH daemon and establish a reverse tunnel to 134.209.82.225:8099.
Installed persistence via a macOS LaunchAgent or a Windows scheduled task/Startup script, retrying the tunnel roughly every minute [1][3].

However, coding errors in the malware's SSH setup routines likely prevented remote access on many affected systems:

On macOS, the malware ran systemsetup -getremotelogin without elevated privileges, producing an administrator-access error instead of the SSH status. Because the code only attempted to enable SSH when the output contained "Off," it skipped the activation step entirely.
On Windows, the malware tried to install and start OpenSSH via PowerShell but invoked it through /bin/sh, a Unix shell not present on standard Windows installations, causing the setup to fail [1].

In both cases, the malware could still install its SSH key, establish persistence, and attempt the reverse tunnel — but if the SSH server was not already running, the tunnel could not provide access. The malware also exfiltrated reconnaissance data to the attacker's server regardless of the SSH outcome [1].

Response and remediation

Cursor removed the malicious extension, took its entire marketplace offline to audit other extensions and rotate all access keys, and worked with the hosting provider to take the command-and-control server offline, disrupting both reverse tunnels and data exfiltration [1][3]. Cursor says its internal investigation found no evidence that other extension versions or official distribution channels were affected [1].

Developers who installed or updated the extension during the exposure window are advised to check for the svc-telemetry SSH key in their authorized_keys file, isolate affected machines, rotate accessible secrets, invalidate sessions, and rebuild environments from clean backups [1][3].

Unanswered questions: how was the package published?

The central unresolved question is how a malicious build was published under Anthropic's name on Cursor's Open VSX mirror.

A Hacker News commenter cited a Binance security post stating that the Open VSX package is owned by Anthropic employee Igor Kofman, per researcher Paul McCarty (6mile). It is unclear whether Kofman's account credentials or another part of the publishing pipeline was compromised [2].
Some Hacker News commenters note Cursor's mirror may have diverged from the main Open VSX registry; Cursor has claimed the tampered files existed only in its mirror [2].
Version 2.1.313's absence from Microsoft's marketplace and Anthropic's GitHub releases suggests the version may have been published and then pulled, or that the version number was skipped on official channels as a precaution, according to Hacker News commenters [2].

Open VSX lacks extension signing and has known weaknesses against typosquatting and rogue publishers — issues multiple commenters contrasted with Microsoft's proprietary marketplace [2]. A Hacker News commenter noted that several AI-enabled IDEs (Cursor, Google's Antigravity, Kiro, Trae, Devin) rely on Open VSX, so a broader registry compromise would have wider impact [2].

What we know vs. what we don't

| Known | Unknown | |-------|---------| | Malicious version 2.1.313 was on Cursor's marketplace for ~11 hours on Oct 29 | How the malicious package was uploaded to Cursor's Open VSX mirror | | Up to 5,000 developers potentially exposed | Whether Anthropic's publishing credentials or an Open VSX/Cursor system was compromised | | Malware collected recon data, installed SSH keys, attempted persistence and reverse tunnels | Whether any attacker successfully gained remote access before the C2 server was taken down | | Coding errors likely prevented SSH access on most machines | Full extent of data exfiltrated from compromised systems | | Cursor rotated keys, audited marketplace, took down C2 server | Whether any other extensions on Cursor's mirror were tampered with |