Cybersecurity researchers have disclosed a security incident involving the official Anthropic Claude Code VS Code extension, which was compromised on the Cursor Marketplace to deploy a persistent SSH backdoor. The issue has been traced specifically to the compromise of the Cursor Marketplace rather than the Open VSX registry, prompting the AI coding platform Cursor to temporarily take down its service to remove the malware.
Cursor confirmed that the incident affected at most 5,000 users who installed the malicious version between approximately 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The company stated that the malicious extension was not developed by Anthropic and does not impact other extensions available on the marketplace, Grok Bot, or other SpaceXAI products. As of October 30, 2026, the compromised version has been removed, and Anthropic has released a clean update, version 2.1.314, to both Open VSX and the Microsoft VS Code Marketplace.
According to Jenn Gile, co-founder of OpenSourceMalware, the malicious package identified itself as anthropic.claude-code version 2.1.313 but contained a 66-line loader inserted before the legitimate code. The extension is designed to activate upon VS Code startup and when its webview opens, subsequently adding an attacker-controlled SSH key labeled "svc-telemetry" to the user's authorized_keys file to appear harmless.
The malware attempts to establish a reverse tunnel to the IP address 134.209.82[.]225 across Windows, Linux, and macOS systems. It also installs platform-specific persistence mechanisms, including scheduled tasks, crontabs, and LaunchAgents, while transmitting host reconnaissance data to an unencrypted HTTP endpoint at port 8099. Cursor noted that enabling the local SSH service requires administrator rights, which the extension lacks on most macOS and Windows hosts; consequently, the tunneling step often fails, though the key installation and data exfiltration still occur.
The exfiltrated data includes the public IP address, hostname, local username, operating system details, CPU architecture, home directory, current working directory, and global Git email. Additionally, the malware scans for up to 40 environment variable names containing keywords such as KEY, TOKEN, SECRET, PASS, AWS, or GCP. Security researcher Paul McCarty highlighted that while the values of these variables are not directly sent in the initial beacon, their names can reveal configured cloud providers and credential types, and successful SSH access would allow attackers to inspect accounts directly.
No follow-on payloads have been observed beyond the reverse tunnel establishment, which provides a pathway for command execution or file transfer. Cursor has indicated it will contact impacted users directly. Affected individuals are advised to isolate their hosts, remove the unauthorized SSH key and persistence mechanisms, and rotate all credentials and sessions.
Sources: The Hacker News.