Malicious Claude Code extension tried to plant SSH backdoor
Cursor says at most 5,000 users were affected and that the attacker's server has been taken offline.
30 Oct 2026 0 reads Compiled with AI
On October 29, a modified version of Anthropic's Claude Code extension, version 2.1.313, was found in Cursor's VS Code extension marketplace. Cursor said the package was not developed by Anthropic. It was available between about 2:27 a.m. and 1:35 p.m. Pacific time that day, and at most 5,000 users were affected. Cursor removed the version, shut down the marketplace as a precaution, and said it found no other tampered extensions. It has no evidence that Anthropic's official distribution was affected.
Discovery and removal
The malicious code added 66 lines of JavaScript that ran before the extension's normal startup. It imported Node.js modules to run commands, read files, gather system data and make network requests. The loader tried to add an attacker-controlled Ed25519 SSH key, with the fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, to ~/.ssh/authorized_keys under the comment svc-telemetry. It then tried to switch on the local SSH service on macOS, Linux or Windows.
The code also set up persistence to keep the backdoor running. On macOS it used a LaunchAgent named com.apple.sysmond.plist, on Linux an @reboot cron entry, and on Windows a SysMon scheduled task, with a startup-folder script named sysmon.cmd as a fallback. It also tried to open a reverse SSH tunnel to the attacker's server at 134.209.82.225 and sent system details to a beacon on port 8099.
Cursor said the attacker's server no longer works. Because the payload can leave persistence scripts behind, uninstalling the extension may not be enough. Cursor recommends checking authorized_keys for the svc-telemetry key, removing persistence, rotating credentials from a trusted system, and running its remediation scripts.