Malicious Claude Code extension on Cursor planted SSH backdoors

A rogue build of Anthropic's Claude Code extension surfaced on Cursor's extension marketplace on October 29, distributing a malicious payload designed to compromise developer machines. The tampered release operated under version tag 2.1.313 and remained accessible for roughly 11 hours between 2:27 a.m. and 1:35 p.m. Pacific Time before discovery. Cursor confirmed that an attacker published the package under Anthropic's official identity, exposing up to 5,000 developers who installed the package during that window. As detailed in BleepingComputer's report, the modified software injected an unauthorized persistence mechanism that targeted both macOS and Windows developer environments through automated shell manipulation.

This briefing details the technical mechanics of the malicious distribution, the specific command-line indicators left on affected hosts, and the remediation steps required for development teams. The analysis applies directly to software engineers using Cursor who downloaded or refreshed the Claude Code extension within the 11-hour exposure timeframe. It documents the reconnaissance routines executed by the payload, the failure modes inside its privilege-escalation scripts, and the network endpoints contacted by compromised systems. Engineering leads and security operations teams can use these details to audit local environments, confirm key telemetry status, and rotate exposed infrastructure secrets.

What shipped in Malicious Claude Code extension on Cursor

The attacker modified the legitimate package by embedding an obfuscated JavaScript loader at the start of the primary extension.js file while leaving standard operational code untouched. When Cursor initiated the extension, this injected header executed immediately in the background without requiring user interaction or an explicit natural-language prompt. The payload gathered local machine telemetry, recorded the system username, hostname, public IP address, and Git author email, and cataloged environment variable keys associated with credentials. All captured host parameters were directed to an external command-and-control server operated at IP address 134.209.82.225.

Beyond baseline information harvesting, the payload wrote an attacker-controlled SSH public key into user configuration files under the label svc-telemetry to establish a permanent reverse tunnel. To retain continuous device access across reboots, the routine registered automated persistence through a macOS LaunchAgent property list or a Windows Startup script. These background routines attempted to refresh the outbound reverse connection back to the attacker infrastructure at intervals of roughly one minute. The script refrained from directly parsing or harvesting token strings, indicating an operational pattern where attackers intended to manually traverse compromised environments after securing remote console sessions.

What improved in Malicious Claude Code extension on Cursor

Security analysts from Phorion and OpenSourceMalware identified coding bugs inside the payload deployment logic that reduced the attack success rate across unprivileged systems. On macOS targets, the script attempted to inspect SSH state with the systemsetup utility using the -getremotelogin argument. Because this administrative utility mandates elevated system privileges, macOS returned an authorization failure instead of reporting state. The malware only triggered its activation routine when reading an explicit response string of Off, meaning the routine halted setup entirely when handling administrative error output on standard user accounts.

A matching failure occurred across standard Windows installations where the malware attempted to configure and start the OpenSSH service. The deployment routine directed PowerShell commands through a Unix shell path at /bin/sh, which does not exist on default Windows systems. While the payload still wrote keys and scheduled recurring execution tasks on both operating systems, the reverse tunnel remained non-functional unless target machines already operated an active, accessible OpenSSH daemon.

What you gain from Malicious Claude Code extension on Cursor

Cursor responded to the incident by unpublishing version 2.1.313, taking its complete extension marketplace offline, and cycling internal infrastructure credentials before resuming service. The company partnered with upstream network hosting providers to null-route and terminate the command-and-control server at 134.209.82.225, severing existing reverse tunnel sockets and blocking exfiltration queues. Cursor's subsequent internal review verified that official distribution pipelines, Microsoft's Visual Studio Code Marketplace, npm, and Open VSX repositories remained uncompromised throughout the incident.

Engineers evaluating potential host impact gain definitive indicators of compromise to audit local development machines. Systems that fetched the extension require inspection for the presence of the svc-telemetry SSH public key entry and associated persistent tasks. Security protocols require teams with confirmed exposure to isolate affected hardware, rotate private repository tokens and cloud secrets held in environment variables, terminate active credential sessions, and restore operating systems from verified baseline backups.

How to get Malicious Claude Code extension on Cursor

Developers restoring clean programming environments must bypass Cursor's tampered marketplace entry and deploy official Claude Code tooling directly from Anthropic's maintained npm distribution. Updating the global package via npm guarantees verified release signatures and replaces corrupted system binaries.

npm install -g @anthropic-ai/claude-code

To update an established local installation through the integrated command-line interface, execute the vendor update command:

claude update

Once installed, developers configure active reasoning targets through in-app model commands during an interactive session:

/model claude-fable-5-1

Teams can alternately set a shorthand model alias directly within the console shell:

/model fable

To launch a pinned terminal session locked to a dedicated model release without modifying background settings, pass the model flag:

claude --model fable

To designate a permanent default model across all future terminal sessions, establish the target through local configuration profiles:

claude config set model fable

What to watch after Malicious Claude Code extension on Cursor

The incident highlights unresolved vulnerabilities surrounding publisher verification mechanisms inside third-party extension catalogs. Cursor has not publicly detailed how external actors successfully posted an unauthorized package under Anthropic's vendor namespace, nor whether upstream administrative credentials were leaked. Development teams must monitor official disclosures from Cursor and Anthropic as engineers determine whether account impersonation stemmed from marketplace authorization gaps or direct compromise of packaging workflows.

Engineering organizations should continuously inspect developer systems for latent scheduled tasks and unauthorized authorized_keys entries created during the exposure window. Because the script transmitted Git identity details alongside variable names for sensitive credentials, security personnel should assume that environment variables present on impacted systems were flagged for reconnaissance. Teams must verify that internal SSH access rules block inbound connections from non-corporate IP ranges, maintain strict credential rotation schedules, and limit automated installation of developer extensions to verified enterprise registries.