Malicious Claude Code extension backdoor exposed in Cursor marketplace

The Marketplace Breach

Cursor, a code editor built on VS Code, announced that a modified version of Anthropic's Claude Code extension was briefly hosted in its marketplace. The specific build, version 2.1.313, was available for about 11 hours on October 29, 2026. According to Cursor, the extension was removed, the marketplace was temporarily shut down for an audit, and the company has since rotated its keys.

While the method used to inject the malicious build into the marketplace remains unknown, early reports suggested it might have originated from Open VSX. However, researchers and the company confirmed the build was traced directly to Cursor's own marketplace. The company stated that no other extensions were tampered with during this incident.

The affected window lasted from approximately 2:27am to 1:35pm Pacific time. During this period, at most 5,000 users could have downloaded the compromised extension. Cursor has since worked with the hosting provider to take down the attacker's server, which is no longer active.

How the Backdoor Works

The malicious code was designed to run automatically as soon as the editor loaded the extension, requiring no user interaction. It began by appending an attacker's Ed25519 public key, labeled svc-telemetry, to the user's authorized_keys file. This allows anyone with the matching private key to log into the machine if the SSH service is reachable.

To facilitate access, the loader attempted to turn on SSH services using system-level commands on Linux, macOS, and Windows. It then tried to establish a reverse tunnel to a specific IP address (134.209.82.225). A reverse tunnel allows an attacker to reach a machine even if a firewall blocks incoming traffic, as the connection is initiated from the user's side.

The malware also included mechanisms to survive a system restart. On macOS, it created a LaunchAgent; on Linux, it added a cron entry; and on Windows, it created a scheduled task. Additionally, it sent a JSON message containing the hostname, username, public IP, and the names of up to 40 environment variables that matched keywords like SECRET, TOKEN, or AWS.

Persistence and Risks

A critical detail of this attack is that simply uninstalling the extension does not remove the threat. Because the extension acts as a delivery vehicle, the SSH keys, startup tasks, and hidden configuration files are planted in locations outside the extension's folder. This means the malware remains active even after the software is deleted.

The actual risk of a successful breach depends on whether the user already had SSH enabled on their machine. Because the extension lacked administrative rights, it likely failed to turn on SSH on most standard macOS and Windows PCs. However, for users who already had Remote Login enabled or were running an SSH daemon on Linux, the tunnel could have successfully connected.

Even if a connection was not established, the attacker may still possess sensitive metadata. The reported JSON message included the user's global Git email and the names of secret environment variables. While the values were not sent, knowing the names of these variables provides a roadmap for an attacker to target specific credentials.

Remediation and Prevention

Cursor has provided specific remediation scripts for macOS and Windows users to clean up the planted files. Users on Linux must manually remove the @reboot cron entry. After running these scripts, users are advised to rotate all credentials and sessions that were reachable by the affected user, starting with any variables matching keywords like PASS or GCP.

To verify if a machine is affected, users can check their authorized_keys file for the svc-telemetry string. If found, the machine should be considered compromised. Security researchers recommend isolating the machine and performing a full rebuild if the SSH tunnel was potentially active during the breach window.

To prevent future incidents, teams should consider disabling automatic updates for extensions in VS Code-based editors. By using the extensions.autoUpdate setting, developers can pin specific versions and maintain a manual list of approved versions. This ensures that a compromised build cannot be automatically pulled into a production environment without human oversight.