Claude Code Extension Delivered SSH Backdoor to 5,000 Devs
5 min read
A maliciously modified version of the Claude Code extension for VS Code reached up to 5,000 developers through Cursor’s extension marketplace on October 29, 2026, according to security notices published by both Cursor and researchers. The compromised version 2.1.313 was distributed through the Open-VSX registry and Cursor’s extension marketplace for approximately 11 hours, during which the tampered code attempted to plant a persistent SSH backdoor on developer machines.
Cursor stated the package was not developed by Anthropic and ran code attempting to install a persistent SSH backdoor, affecting at most 5,000 users. The company removed the malicious extension and temporarily shut down its marketplace while investigating the incident.
Technical Details of the Attack
The compromised extension.js file started with an injected immediately invoked function expression (IIFE) prepended to the minified extension bundle, while the rest of the bundle looked like the standard extension. Security researchers analyzing the malicious code found that it executed automatically when the extension loaded, without requiring users to actively start a Claude conversation.
The modified extension collected host and user information including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email address, and the machine’s public IP address. This data was exfiltrated to attacker-controlled infrastructure.
Beyond data collection, the malicious code attempted to establish persistent remote access. The implant appended an attacker-controlled Ed25519 public key labeled svc-telemetry to ~/.ssh/authorized_keys, enabling the attackers to maintain SSH access even after the extension was removed.
Timeline and Distribution
The malicious package, version 2.1.313 of Anthropic’s Claude Code extension, was available in the marketplace between approximately 2:27 a.m. PT and 1:35 p.m. PT on October 29, 2026. During this window, developers using Cursor who installed or updated the Claude Code extension received the compromised version.
Microsoft’s Visual Studio Marketplace, VS Code’s default extension store, reported no malicious version. The compromise specifically affected users of Cursor’s marketplace, which mirrors extensions from Open-VSX.
Remediation Steps Required
Uninstalling the extension alone is not sufficient, as the loader drops standalone persistence that survives removal. Security researchers and Cursor have emphasized that affected systems should be treated as fully compromised.
Cursor stated in a security notice that the company would reach out to affected users directly. The company has published commands for check and cleanup scripts for macOS and Windows, and both Cursor and security researchers have shared indicators of compromise.
Published indicators of compromise include SHA-256 hashes for the modified darwin-arm64 and win32-x64 VSIX packages, and a modified extension.js file in the macOS or Windows 2.1.313 extension folder containing the strings 134.209.82.225 and svc-telemetry.
Users who installed version 2.1.313 are advised to isolate affected systems, remove unauthorized SSH keys from authorized_keys files, check for suspicious processes and network connections, rotate credentials that may have been exposed, and review system logs for unauthorized access attempts.
Enterprise Security Response
The incident coincides with broader developments in Claude Code enterprise security. Trust3 AI recently announced an integration between its Agent DOS platform and Claude Code, providing enterprise monitoring and governance capabilities. The integration offers visibility into Claude Code activity, users, and connected tools through Anthropic APIs.
Separately, Anthropic introduced enterprise reporting features designed to help managers evaluate Claude Code usage, costs, output, and workflow bottlenecks. The company also announced pooled group budgets and confirmed that customer data would not be used for model training by default.
Verified Safe Versions
Versions 2.1.312 and 2.1.314 have been verified clean. Security researchers recommend that users update to version 2.1.314 or later if they had previously installed the Claude Code extension through Cursor’s marketplace.
The supply-chain compromise highlights ongoing risks facing developer tools and extension marketplaces. As IDE extensions gain privileged access to developer environments, source code, and credentials, they represent high-value targets for attackers seeking to compromise software supply chains or conduct espionage against development teams.
Key Facts
- Affected version: Claude Code extension 2.1.313
- Distribution window: Approximately 11 hours on October 29, 2026 (2:27 a.m. to 1:35 p.m. PT)
- Impact: Up to 5,000 Cursor users potentially affected
- Attack method: Malicious IIFE prepended to extension.js bundle
- Payload: SSH backdoor via authorized_keys modification, system information exfiltration
- C2 infrastructure: IP address 134.209.82.225
- Safe versions: 2.1.312 (prior) and 2.1.314 (current) verified clean
Sources
- Help Net Security – Claude Code extension poisoned with persistent SSH backdoor
- Unite.AI – Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension
- StepSecurity – Trojanized Claude Code Extension Delivered Persistent SSH Backdoor
- The Hacker News – Official Claude Code VS Code Extension Compromised
Sources
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines – StepSecurity
- Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension
- Claude Code extension poisoned with persistent SSH backdoor – Help Net Security
- Hackers Compromise Claude Code Extension in Cursor Marketplace to Install Persistent SSH Backdoor
- Claude Code Extension 2.1.313 SSH Backdoor Analysis – Threat Landscape Blog
