Compromised Claude Code extension installs SSH backdoors on 5,000 users

The Marketplace Compromise

Cybersecurity researchers recently identified a security incident involving a modified version of the official Anthropic Claude Code extension. The malicious package was hosted on the Open VSX registry and was specifically accessed through the Cursor IDE extension marketplace. This distribution channel allowed the malware to reach a significant number of developers who rely on AI-assisted coding tools.

The malicious version identified itself as anthropic.claude-code version 2.1.313. However, researchers found that the main JavaScript bundle contained a 66-line loader inserted before the legitimate extension code. This loader was designed to execute immediately after the VS Code startup and when the extension's webview opened.

Cursor, the AI coding platform, briefly took down its service to remove the malware from its marketplace. The company confirmed that the incident did not affect other extensions like Grok Bot or other products owned by SpaceXAI. They stated that the malicious version was not developed by Anthropic and was a result of a marketplace compromise.

How the Backdoor Works

Once the extension was activated, it proceeded to modify the user's local environment by adding an attacker-controlled key to the "~/.ssh/authorized_keys" file. To avoid detection by the user, the malware labeled this key as "svc-telemetry" to make it appear like a standard system service. This action allows an attacker to gain access to the host via the SSH service.

The malware also attempted to establish a reverse tunnel to the IP address 134.209.82[.]225. To ensure it could remain on the system after a reboot, it installed platform-specific persistence mechanisms. Depending on the user's operating system, it created a scheduled task, a crontab, or a LaunchAgent to keep the connection active.

Furthermore, the extension transmitted host reconnaissance data to the same remote IP address on port 8099. This data was sent via an unencrypted HTTP request to a specific beacon. The reconnaissance included the user's public IP address, hostname, local username, and the operating system's CPU architecture.

Data Exfiltration Details

The malware was designed to gather a wide range of sensitive system information from the infected machines. It collected the home directory, the current working directory, and the global Git email address from the user's configuration. These details help attackers map out the developer's local environment and identify their identity.

More significantly, the extension targeted environment variables. It searched for and collected the names of up to 40 variables containing keywords like KEY, TOKEN, SECRET, PASS, AWS, or GCP. While the actual values of these variables were not placed in the initial beacon, the names themselves can reveal which cloud providers or CI systems a developer uses.

Security researchers noted that while the initial beacon was limited, successful SSH access would allow an operator to inspect the account directly. This could provide a pathway for the attacker to issue commands or transfer files. No other follow-on payloads have been observed since the initial infection occurred.

Impact and Remediation

Cursor reported that the incident affected at most 5,000 users who installed the malicious version during a specific window on October 29, 2026. The company is currently reaching out to these impacted users directly to provide assistance. The malicious package was officially removed from the registry on October 30, 2026.

Anthropic has since published a clean version, 2.1.314, to both the Open VSX and Microsoft VS Code marketplaces. Because the extension supports auto-updates, users who had the feature enabled may have automatically downloaded the compromised version without manual intervention.

The company noted that turning on the local SSH service typically requires administrator rights, which the extension lacked on most macOS and Windows hosts. On those systems, the tunnel setup failed, but the malware still successfully added the SSH key, installed persistence, and sent host details to the attackers. Users are still advised to follow remediation steps regardless of their OS.