Trojanized Claude Code Extension 2.1.313 in Cursor Marketplace Plants SSH Backdoor

TL;DR: A modified build of the Claude Code for VS Code extension, labelled Anthropic.claude-code version 2.1.313, was available in Cursor's own VS Code extension marketplace between about 11:27 and 22:35 Cyprus time (UTC+2) on 29 October 2026, according to Cursor's security notice. Cursor says the build was not developed by Anthropic and that at most 5,000 users were affected; it says it will contact them directly. According to Cursor and to analysis by OpenSourceMalware, code added to the start of extension.js adds an attacker's SSH key, tries to turn on the machine's SSH service, tries to open a reverse SSH tunnel to 134.209.82.225, sets up persistence, and sends host details to the same server. Severity: High (Rescana's assessment for a developer-tool supply-chain compromise; no CVE or CVSS score has been assigned). What to do: if anyone installed or updated Claude Code in Cursor during that window, run Cursor's check for the svc-telemetry key and follow its remediation steps. Removing the extension alone may not remove the backdoor.

What lowers the urgency for most readers:

• One build in one marketplace. Cursor identified the malicious package in its own VS Code extension marketplace, says it audited access and found no other tampered extensions, and says it has "no evidence that other versions of the extension or the official distribution are affected." OpenSourceMalware's updated post says the npm package, the Open VSX extension and the Microsoft VS Code Marketplace extension are not malicious.
• The attacker's server is offline. Cursor says it worked with the hosting provider to take 134.209.82.225 offline, so the tunnel and the host report no longer work.
• The SSH step usually fails. Cursor says that turning on SSH needs administrator rights, which the extension does not have on most macOS and Windows machines, so on those machines the attacker could not have logged in through the tunnel. Phorion separately reports a likely oversight in the macOS check that makes the enable step fail for standard users.
• The bad version is gone. Cursor says it removed the package as soon as it was detected, blocked further distribution, shut down and rebuilt its marketplace and rotated its keys. The current version is 2.1.314 for the extension on Open VSX and the Microsoft Marketplace, and for the Claude Code CLI on npm.

The catch: the key, the persistence entries and the host report can still have landed even when the SSH step failed, and they stay after the extension is updated or removed. Cursor's advice is to run the remediation steps whether or not the tunnel worked.

What happened

Cursor runs its own VS Code extension marketplace for the Cursor editor. On 29 October 2026 (US Pacific time), Cursor identified a malicious Anthropic.claude-code 2.1.313 package there. Cursor removed it, then shut down the whole marketplace as a precaution, rotated its keys, rebuilt the marketplace and brought it back online. Cursor published a security notice with indicators and remediation scripts for macOS and Windows, and posted about it on X at 09:46 Cyprus time on 30 October.

How the attacker got the package into Cursor's marketplace has not been explained. OpenSourceMalware says Cursor told it that the Claude Code extension in the Cursor Marketplace "experienced some form of compromise." Cursor's notice does not describe the entry point, and nobody has said who is behind it. Anthropic has not published a statement that we could find on its news page, status page or the Claude Code GitHub security advisories. Anthropic's Claude Code changelog goes from 2.1.312 to 2.1.314, with no 2.1.313 entry.

Early reports named the wrong registry. OpenSourceMalware first reported that the build came from Open VSX, and Phorion's advisory still says so. OpenSourceMalware has since corrected its post after Cursor contacted it. Open VSX has no record of a 2.1.313 version. Phorion also writes that Anthropic pulled 2.1.313 from npm and the VS Code Marketplace. We could not confirm that from any Anthropic or registry source: npm has no record of a 2.1.313 version, and the Microsoft Marketplace version list goes from 2.1.312 to 2.1.314.

Technical information

This summary comes from Cursor's notice and the public analyses by OpenSourceMalware and Phorion. Rescana did not download or run the extension.

• Reconnaissance. When the extension loads, the code collects the hostname, username, operating system and CPU architecture, home and working directories, the global Git email address, the public IP address, and the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP. OpenSourceMalware says the values are not sent in the report. Cursor notes that this limited collection does not rule out later credential access over the backdoor.
• SSH key planting. It appends an attacker-controlled Ed25519 public key with the comment svc-telemetry to ~/.ssh/authorized_keys.
• SSH service enablement. It tries to enable macOS Remote Login, the Linux sshd/ssh service, or OpenSSH Server on Windows. Cursor says this fails without administrator rights.
• Reverse SSH tunnel. It writes an embedded tunnel key to a temporary file named .stk_<id> and keeps an outbound SSH connection open to tunnel@134.209.82.225, forwarding a port on that server back to the machine's own SSH port (-R *:0:localhost:22). Background scripts retry about every 60 seconds and use autossh when it is installed.
• Persistence. On macOS: a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist with scripts in ~/.config. The name imitates Apple's naming, but this is not an Apple component. On Windows: a scheduled task named SysMon that tries to run as SYSTEM, with a sysmon.cmd script in the Startup folder as a fallback. OpenSourceMalware also describes a Linux branch that adds an @reboot crontab entry; Cursor's indicators cover the macOS (Apple silicon) and Windows builds.
• Beacon. It sends a JSON report over plain HTTP to 134.209.82.225:8099/beacon (and to 127.0.0.1:8099). According to OpenSourceMalware, the code downloads no further malware and ignores the server's response.

ARIN's registration data places 134.209.82.225 in a DigitalOcean hosting range. That identifies the hosting provider, not the attacker.

Timeline (Cyprus time, UTC+2)

• 29 October 2026, about 11:27–22:35: malicious 2.1.313 available in Cursor's VS Code extension marketplace (Cursor: 2:27am–1:35pm PT).
• 30 October, 02:12–03:20: 2.1.314 published on npm, Open VSX and the Microsoft Marketplace, according to registry timestamps.
• 30 October, before 10:00: OpenSourceMalware and Phorion publish analyses that initially attribute the build to Open VSX.
• 30 October, 09:46: Cursor posts about the incident on X. OpenSourceMalware then updates its post to name the Cursor marketplace as the origin.
• 30 October, 10:00–10:15: Rescana checks: Open VSX, npm and the Microsoft Marketplace have no 2.1.313; current version 2.1.314; no Anthropic statement, CVE or KEV entry.

CVE and KEV status

No CVE has been assigned, and nothing related appears in the CISA Known Exploited Vulnerabilities catalog (version 2026.10.29, checked 30 October 2026). This is a malicious build in a marketplace, not a flaw in Claude Code, so a CVE may never be assigned.

Affected Product Versions

Workaround and Mitigation

1. Find exposure.

• Identify Cursor users who had Claude Code for VS Code installed and could have installed or updated it between about 11:27 and 22:35 Cyprus time on 29 October. Check the extensions folder for anthropic.claude-code-2.1.313*.
• Everyone using Claude Code for VS Code: confirm the installed version is 2.1.314 or later.

2. Check for the key and indicators, even on machines that are already updated.

• Run Cursor's published check for the svc-telemetry key in ~/.ssh/authorized_keys (and, on Windows, C:\ProgramData\ssh\administrators_authorized_keys). Match on the key fingerprint too, because a comment can be changed.
• Look for the persistence files, the LaunchAgent, the SysMon task and the Startup script.
• Look for long-running ssh or autossh processes using -R *:0:localhost:22, and for connections to 134.209.82.225 on ports 22 or 8099.

3. If the key or persistence is present, treat it as an incident.

• Isolate the machine and preserve evidence.
• Remove the key, persistence and tunnel processes. Cursor publishes remediation scripts for macOS (run as the affected user) and Windows (run as Administrator) in its notice.
• Rotate credentials and sessions the account could reach, from a trusted machine.
• Decide whether to rebuild. Cursor asks affected users to assess whether the host should be rebuilt; OpenSourceMalware says rebuilding is safer than assuming the known files were the whole compromise.

4. Longer term.

• Decide which extension marketplaces your developers' editors may use.
• Pin or allow-list extensions for high-privilege tools like AI coding assistants.
• Monitor developer machines for new SSH keys, new persistence and unusual outbound SSH.

Indicators of Compromise

Source: Cursor's security notice, with matching values from OpenSourceMalware and Phorion where noted.

Not known: how the package entered Cursor's marketplace, who ran the server, or what was done through any tunnel that connected.

What we will update

We will update this post if:

• Cursor or Anthropic publishes a root cause or post-mortem.
• Anyone shows that a registry other than Cursor's marketplace served 2.1.313.
• A CVE or GitHub security advisory is assigned.
• Researchers publish new indicators or evidence of activity through the tunnel.

Why this matters for your vendors

This one did not come from the publisher or the main registries. It came from a marketplace that one editor maker runs for its own users. Your vendors' developers may use Cursor or other AI editors that pull extensions from sources your security team has never reviewed, and an extension runs with the developer's access to code, SSH keys and cloud credentials.

Questions worth asking your software and SaaS vendors:

• Do your developers use Cursor, and did any of them install or update Claude Code for VS Code on 29 October 2026?
• Have you run Cursor's check for the svc-telemetry key, and what did you do where it was found?
• Which credentials did you rotate, and did you rebuild affected machines?
• Which extension marketplaces may your developers' editors use, and do you pin AI coding tool versions?
• Do you monitor developer machines for new SSH keys, new persistence and unusual outbound SSH?

If you want help mapping which of your vendors may be affected by developer-tool supply-chain incidents like this one, talk to Rescana.

Sources

• Cursor, "Claude Code extension security notice" (29 October 2026): https://cursor.com/blog/claude-code-extension-security-notice
• OpenSourceMalware, "Trojanized Claude Code Extension Plants an SSH Backdoor" (30 October 2026, updated): https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor
• Cursor on X (30 October 2026): https://x.com/cursor_ai/status/2116074289053175808
• Phorion, "Official Claude Code Extension Compromise: Security Advisory" (30 October 2026; its Open VSX attribution is superseded by Cursor's notice, cited here for indicators): https://phorion.io/blog/offical-claude-code-vsx-compromise/
• Open VSX, Claude Code for VS Code listing: https://open-vsx.org/extension/Anthropic/claude-code
• Microsoft Visual Studio Marketplace, Claude Code for VS Code listing: https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code
• Anthropic, Claude Code changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md