Malicious Claude Code extension plants SSH backdoor on 5,000 users

The supply chain compromise

A security incident involving the Claude Code extension has revealed how easily attackers can compromise developer tools. As NewsCord reported, a trojanized version of the extension, specifically version 2.1.313, was distributed through the Cursor marketplace. This malicious build was not created by Anthropic but was instead injected into the official distribution channel.

The breach occurred on October 29, 2026, when the compromised package became available for download. Because it was hosted on a trusted platform, it was able to reach a significant number of users who likely downloaded or auto-fetched the update. The attack is described as a supply-chain compromise, meaning the attackers gained control of the delivery system itself.

Cursor confirmed that the incident affected at most 5,000 users. The company has since taken steps to mitigate the damage by removing the malicious version and shutting down its VS Code marketplace as a precaution. They also conducted a full audit of their marketplace to ensure no other extensions were tampered with during the breach.

How the backdoor functioned

The technical execution of the attack relied on an injected immediately invoked function expression within the extension.js file. This specific type of code allows the payload to execute automatically as soon as the Node environment loads the file. This means the user does not need to interact with the extension for the malicious code to fire.

Once active, the code attempted to install a persistent SSH backdoor on the user's machine. It specifically aimed to add an attacker-controlled SSH key to the user’s authorized keys file. Additionally, the extension tried to enable the local SSH service and open a reverse SSH tunnel to a specific remote IP address.

The malware was designed to be cross-platform, targeting Windows, macOS, and Linux systems. It also attempted to transmit host reconnaissance data to a specific beacon over an unencrypted HTTP request. While turning on the local SSH service usually requires administrator rights, the extension still managed to add the SSH key and install persistence on many machines.

Impact on developers

The primary victims of this incident are developers who use the Cursor marketplace for their coding environments. Because the extension was distributed through a reputable channel, many users may have installed it without realizing it was a compromised build. The persistence of the SSH backdoor means that attackers could potentially maintain access to these machines even after the initial installation.

Cursor has stated that they plan to contact the impacted users directly to inform them of the breach. They have also worked with the cloud provider hosting the attacker's server to take it offline. This action successfully stopped both the active tunnels and the transmission of reconnaissance data from the infected machines.

While the damage was significant, Cursor noted that other products like Grok or other SpaceXSI products were not impacted. They also clarified that the breach did not affect other extensions downloaded from their marketplace. Anthropic has since released version 2.1.314 to replace the malicious build on other major marketplaces.

Remediation and recovery

In response to the breach, Cursor took several immediate actions to secure their infrastructure. They rotated their keys and rebuilt the entire marketplace from the ground up. This process was intended to ensure that the distribution channel is once again clean and secure for all users.

The security community has also stepped in to provide identification tools for affected systems. Step Security's Dev Machine Guard now flags version 2.1.313 as malicious. This allows developers to check their installed versions and confirm whether they are running a clean build or a compromised one.

Anthropic has also moved to rectify the situation by pushing the clean version 2.1.314 to both Open VSX and the Microsoft VS Code Marketplace. They reported that users who installed Claude Code through those specific marketplaces are not known to be affected. The incident serves as a major case study on the importance of monitoring supply-chain integrity.