Malicious Claude Code extension found in Cursor Marketplace

Detection of malicious extension

Cursor identified a security incident involving a specific package in its VS Code extension Marketplace. The package was a maliciously modified version of the Anthropic.claude-code extension, specifically version 2.1.313. This version was not developed by Anthropic but was made available to users for a short window of time.

The malicious extension appeared in the marketplace between approximately 2:27am PT and 1:35pm PT on October 29, 2026. During this period, it was accessible to users who were looking for the official Claude Code tool. Cursor acted quickly to remove the package and block any further distribution to the public.

To ensure the safety of the platform, Cursor followed a full shutdown of the VSCode Marketplace out of an abundance of caution. The team conducted a full audit of the marketplace to confirm that no other extensions were tampered with during the incident. They also rotated their keys and rebuilt the marketplace before bringing it back online.

How the backdoor functioned

The malicious extension was designed to run code that attempted to install a persistent SSH backdoor on the user's machine. It specifically targeted the 'authorized_keys' file to add an attacker-controlled SSH key. It also tried to enable the local SSH service and open a reverse SSH tunnel to allow remote access.

To maintain access, the malware attempted to create persistence mechanisms. On macOS, it tried to use a LaunchAgent, while on Windows, it attempted to create a scheduled task that would run as SYSTEM. The scripts were designed to retry the tunnel connection roughly every 60 seconds to ensure the connection remained active.

The extension also functioned as a data collection tool for the attacker. It gathered various host details, including the hostname, username, operating system, architecture, home directory path, and environment variable names. It even attempted to collect the user's configured Git email and public IP address.

Impact on affected users

Cursor reported that at most 5,000 users were affected by this specific malicious package. The company is reaching out directly to those individuals to provide guidance. While the attacker's server is currently offline, the extension still succeeded in some actions on many machines.

Due to technical errors in the malicious code, the step to enable the local SSH service often failed because the extension lacked administrator privileges. This meant that on many macOS and Windows hosts, the attacker could not actually log in through the tunnel. However, the extension still successfully added the unauthorized SSH key and installed the persistence scripts.

The malware also sent host details to an attacker server via an HTTP POST request to a specific beacon endpoint. Because the hosting provider took the server offline, these specific POST requests are no longer functional. Despite this, the fact that the extension successfully dropped standalone persistence scripts means that simply uninstalling the extension is not enough to clean the system.

Remediation and next steps

Users who installed version 2.1.313 are urged to run specific checks to see if they were impacted. On macOS, users can use a grep command to search for a key labeled 'svc-telemetry' in their authorized_keys file. Windows users can run a similar PowerShell command to check both the user and administrator authorized keys.

If a key is found, the user's machine is considered impacted and requires manual cleanup. Cursor has provided specific remediation scripts for both macOS and Windows to remove the unauthorized keys, persistence mechanisms, and running tunnel processes. These scripts must be run by the affected user rather than as a root user to ensure they target the correct profile.

Because the extension collected environment variables, there is a possibility of later credential access over the backdoor. Affected users should rotate all credentials and sessions that were accessible from the compromised hosts. It is also recommended that users assess whether their hosts should be completely rebuilt following the cleanup process.