Malicious Claude Code Extension Compromises Up to 5,000 Cursor Users with Persistent SSH Backdoor

Introduction

On October 29 2026, a malicious version of Anthropic’s Claude Code extension appeared in the Cursor AI‑powered IDE marketplace. For roughly 11 hours the compromised package (version 2.1.313) was available to Cursor users, injecting a persistent SSH backdoor into the host machines of up to 5,000 developers. The attack demonstrated how a seemingly innocuous editor extension can become a powerful vector for supply‑chain compromise.

• --

Timeline of the Incident

| Time (PDT) | Event |
|------------|-------|
| 02:27 AM | Malicious Claude Code extension (v2.1.313) goes live in Cursor marketplace |
| 01:35 PM | Extension removed after discovery |
| 10:36 AM (Oct 30) | Bill Toulas reports the breach on BleepingComputer |
| Oct 30‑31 | Microsoft Security Blog, The Hacker News, and other outlets publish technical analyses |

• --

Technical Analysis

What the malicious code did

1. Loader Insertion – A 66‑line JavaScript loader was prepended to the legitimate extension bundle. The loader runs before any of Claude Code’s normal functionality.
2. Host Enumeration – Using Node.js APIs, the loader gathers OS details, environment variables, and checks for running antivirus/EDR solutions. If security software is detected, execution halts.
3. SSH Backdoor Installation – The extension writes an attacker‑controlled public key (labelled svc‑telemetry) to the user’s ~/.ssh/authorized_keys file, creating a persistent SSH tunnel.
4. Credential Harvesting – Environment variables containing API tokens, cloud credentials, and other secrets are exfiltrated to a remote C2 server.
5. Persistence via VS Code Activation – The extension’s activationEvents trigger on VS Code start‑up and when its webview opens, guaranteeing execution without further user interaction.
6. Command‑and‑Control – A Merlin‑style agent is downloaded, giving the attacker full remote access to the compromised host.

CVE References

• CVE‑2025‑54135 – Related to a Claude Code RCE flaw discovered by researcher joernchen.
• CVE‑2026‑39861 – Covers the malicious package distribution in Cursor’s marketplace.
• CVE‑2026‑48124 – Allows a malicious repository’s .claude/settings.local.json to execute commands inside Cursor.
• --

Impact Assessment

• Affected Users: Up to 5,000 developers who installed the extension during the 11‑hour window.
• Financial Loss: Reported theft of $500 (likely a placeholder; the real impact includes potential credential leakage and downstream breaches).
• Persistence: The added SSH key survives system reboots and user password changes, making remediation non‑trivial.
• Scope: Only the Cursor marketplace distributed the malicious package; Microsoft’s VS Code Marketplace, Open VSX, and npm were not involved.
• --

Remediation Steps

1. Isolate Affected Machines – Disconnect from networks to stop further exfiltration.
2. Rotate Secrets – Regenerate any API keys, cloud credentials, and passwords that may have been exposed.
3. Invalidate Sessions – Revoke active SSH sessions and any tokens stored in environment variables.
4. Remove the Malicious Extension – Uninstall anthropic.claude-code version 2.1.313 and reinstall the clean version (≥ 2.1.314).
5. Rebuild from Clean Backups – Where possible, restore the development environment from a known‑good snapshot.
6. Audit authorized_keys – Delete any unknown entries, especially those labeled svc‑telemetry.

• --

Preventive Controls for Organizations

| Control | Description |
|---------|-------------|
| Extension Whitelisting | Allow only extensions from vetted publishers. |
| Installation Cool‑down | Configure Cursor to delay the activation of newly published extensions (e.g., 24‑hour hold). |
| Code Review of Extensions | Encourage developers to inspect extension.js and other entry points before installation. |
| Endpoint Monitoring | Deploy EDR solutions that can detect unusual file writes to ~/.ssh/authorized_keys. |
| Supply‑Chain Scanning | Use tools that scan VS Code extensions for hidden payloads (e.g., Snyk, Trivy). |

• --

Lessons Learned

• Editor Extensions Are High‑Value Targets – Attackers can achieve persistence and credential theft with a few lines of JavaScript.
• Supply‑Chain Vigilance Is Crucial – Even trusted marketplaces can be compromised; verification must extend beyond the publisher’s reputation.
• Rapid Incident Communication Saves Time – Cursor’s swift acknowledgment and removal of the malicious package limited exposure.
• Developer Hygiene Matters – Regularly auditing SSH keys and environment variables can mitigate the damage of a backdoor.
• --

Conclusion

The malicious Claude Code extension incident is a stark reminder that the tools developers rely on daily can become the weakest link in the security chain. By applying strict extension controls, monitoring for anomalous behavior, and maintaining disciplined secret‑management practices, organizations can defend against similar supply‑chain attacks in the future.

• --