Malicious Claude Code extension on Cursor exposed up to 5,000 developers

Cursor identified and removed malicious versions of Anthropic's Claude Code extension after they were distributed on the Cursor VS Code Extension Marketplace for approximately 11 hours on October 29, 2026. Available between about 2:27 a.m. and 1:35 p.m. Pacific Time, versions 2.1.312 and 2.1.313 for Windows and macOS exposed up to 5,000 developers to malware that attempts to install a persistent SSH backdoor. Cursor stated that Anthropic did not develop the modified packages.

Researchers at Phorion and OpenSourceMalware found that attackers inserted a malicious JavaScript loader into extension.js that executes without user interaction. The payload sends host details, including hostname, username, operating system, configured Git email, public IP address, and environment variable names, to an attacker server at 134.209.82.225. It also adds an unauthorised SSH key labelled svc-telemetry to authorized_keys and installs a macOS LaunchAgent or Windows scheduled task that retries a reverse tunnel roughly every 60 seconds.

According to Cursor and Phorion, coding errors and missing administrator privileges prevented the malware from enabling the local SSH service on most Windows and macOS hosts where SSH was not already running. On macOS, running systemsetup -getremotelogin without elevated privileges produces an error that skips activation, while on Windows the malware tries to run PowerShell via /bin/sh, a Unix shell unavailable on standard Windows systems.

Upon detection, Cursor removed the malicious package, temporarily shut down its marketplace, confirmed no other extensions were tampered with, rotated its keys, and rebuilt the marketplace. It also worked with the hosting provider to take the attacker's server offline. Although initial reports suggested npm, Open VSX, and Microsoft's Visual Studio Code Marketplace were impacted, only Cursor distributed the malicious extension.

Developers who installed versions 2.1.312 or 2.1.313 during the exposure window should check for the svc-telemetry SSH key and run Cursor's remediation scripts, remediate-macos.sh or remediate-windows.ps1. Cursor advises affected users to isolate impacted hosts, remove the unauthorised key, persistence mechanisms, and tunnel processes, rotate credentials and sessions from a trusted system, and assess rebuilding the host, while BleepingComputer awaits responses from Anthropic and Cursor on the attack.

Sources: Cursor, BleepingComputer

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.