Malicious Claude Code extension served on Cursor marketplace

The Cursor Marketplace Breach

On October 29, 2026, a tampered version of the Claude Code extension was discovered on the Cursor marketplace. The malicious package, identified as versions 2.1.313 and 2.1.312, was live for a few hours. It was designed to perform a supply-chain attack against developers using the Cursor platform.

Microsoft Threat Intelligence confirmed that the official npm and Microsoft Visual Studio marketplaces were not affected. Anthropic also stated that their internal systems were not compromised during this incident. The breach appears to have been isolated specifically to the Cursor extension marketplace.

The malicious extension functioned normally to avoid alerting the user while running hidden code in the background. It used Node.js APIs to gather information and modify system files. This allowed the loader to execute commands without the user noticing any disruption in the tool's primary features.

How the SSH Backdoor Works

The injected JavaScript first performed reconnaissance by collecting the host's username, operating system, and architecture. It also scanned for environment variables containing sensitive terms like SECRET, TOKEN, or AWS. While it did not steal the values, it identified which configuration categories were present on the system.

To establish a backdoor, the loader attempted to append a public key to the user's authorized_keys file. It then tried to enable the local SSH service and create a reverse tunnel. This design allows the attacker to request a listening port on a remote server and forward connections back to the victim's workstation.

The malware used specific identities to handle different roles in this connection. One key authorized access to the user account, while another authenticated the outbound connection to the tunnel server. It also used platform-specific scripts to ensure the connection would restart automatically if it ever closed.

Persistence and Stealth Tactics

The loader was designed to stay active on a machine by writing scripts outside of the extension's directory. On Windows, it created scheduled tasks and startup folder entries using names like SysMon. On Unix-like systems, it used crontab entries and LaunchAgents to maintain its presence.

These names were chosen because they resemble legitimate monitoring components used by system administrators. By mimicking these names, the malware aimed to blend in with standard system processes. The scripts were configured to reconstruct the necessary identities and restart the SSH retry loops if they failed.

To remain hidden, the loader suppressed all command output and silently caught any errors that occurred during execution. This ensured that if a specific step failed, such as a permission error, the user would not see a crash or warning. The extension continued to work as expected while the malicious loader attempted to establish access.

Impact on Users and Organizations

Successful remote access depended on the host's privileges and the specific configuration of the attacker's server. However, the malware could still plant keys and persistence artifacts even if the tunnel failed. This means a machine could be compromised even if the attacker never successfully connected to it.

Cursor reported that administrator permission requirements blocked the SSH access on many macOS and Windows hosts. Despite these blocks, the loader may have still written the malicious keys and scripts to the disk. Organizations must now identify any systems that automatically updated to the affected versions during the window of exposure.

Affected users are advised to check their authorized_keys files for any entries labeled svc-telemetry. They should also look for specific temporary files like .stk_ or scripts in the .config directory. Removing the extension alone is not enough, as the malware writes artifacts to locations outside of the extension folder.

Next Steps for Remediation

Security teams should prioritize isolating devices that show evidence of the loader's execution. This includes reviewing endpoint and network telemetry for connections to the reported malicious IP addresses. It is important to preserve the extension package and any generated scripts before they are deleted for forensic analysis.

Users need to manually remove the unauthorized SSH keys and startup objects from their systems. Cursor has provided platform-specific scripts to help automate this cleanup process. These scripts help identify and remove the specific files and tasks created by the malicious loader.

To prevent future supply-chain attacks, organizations can restrict extension installations to approved publishers. They can also configure a cooldown period for new versions to allow time for community vetting. These steps help ensure that new updates are not automatically installed before they can be verified for safety.