Q.QIBA AIAI model, product, industry, and policy news
Sites
SearchSaved0

Explainer / Published 2026-10-31

A poisoned Claude Code extension exposed Cursor's supply chain

A malicious build of Anthropic's Claude Code extension spent about 11 hours on Cursor's marketplace, reaching up to 5,000 developers, though coding errors blunted its SSH backdoor.

Q.QIBA AI deskSource-backed article · 4 min read
Event date Prepared Published 2026-10-31
An open laptop on a wooden desk beside a black mug, with daylight from a window behind it and a clean overlay reading Trust in the plugin.
Editorial photograph of a desk and laptop used as an illustration for this story; it does not depict Anthropic, Cursor, or any real screen or extension.

THE SHORT VERSION

  • A malicious build of Anthropic's Claude Code extension was distributed through Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers.
  • The malware added an SSH key labelled svc-telemetry, installed persistence and sent host reconnaissance data, but coding errors stopped it enabling SSH on many machines.
  • Cursor pulled the extension, shut its marketplace to audit other packages and rotated access keys; Open VSX and Microsoft's marketplace were not affected.

Eleven hours on a marketplace

A malicious version of Anthropic's Claude Code extension for Visual Studio Code was distributed through Cursor's extension marketplace for roughly 11 hours on October 29, according to BleepingComputer, which put the exposure at up to 5,000 developers. The package carried version number 2.1.313 and was available between about 2:27 a.m. and 1:35 p.m. Pacific Time.

Cursor is an AI-powered code editor built from Microsoft's open-source Visual Studio Code, and it accepts VS Code extensions. That makes its marketplace a distribution channel for tools that developers install with the same trust they give the editor itself. Anthropic's Claude Code extension puts its coding assistant inside compatible editors, and anyone with auto-update enabled could have taken the malicious build without doing anything unusual.

It was not a fake extension

The important detail is that the package did not impersonate Anthropic with a lookalike name. The Hacker News reported that it was distributed under Anthropic's legitimate extension identifier, anthropic.claude-code, as version 2.1.313. Researchers at OpenSourceMalware told the outlet that the bundle contained a malicious 66-line loader inserted at the start of the extension's main JavaScript file, with the legitimate code otherwise unchanged.

Cursor said the malicious version was not developed by Anthropic, which is true and does not answer the interesting question. Cursor has not explained how attackers managed to publish an update under Anthropic's publisher identity inside its marketplace. BleepingComputer reported that Cursor says Anthropic did not develop the malicious package but has not explained how the compromised version was distributed under Anthropic's name.

What the malicious build did

The payload activated after the editor started and its webview opened. It added an attacker-controlled key to the developer's ~/.ssh/authorized_keys file, labelling it svc-telemetry so it would look like ordinary monitoring, then tried to make the machine reachable over SSH and establish a reverse tunnel to a remote server. It installed persistence through a Windows scheduled task or startup script, a crontab entry, or a macOS LaunchAgent, and it retried the tunnel about once a minute.

Even when the tunnel failed, the malware sent reconnaissance data to an attacker-controlled address, including the victim's username, hostname, public IP address, Git email address and the names of environment variables associated with sensitive credentials. BleepingComputer reported that the script does not directly steal credentials, which suggests the plan was to retrieve data by hand once access worked.

Why the backdoor often did not work

Much of the attack failed for ordinary programming reasons. On macOS the malware checked whether Remote Login was enabled by running a system command without elevated privileges, so the command returned an administrator-access error instead of the SSH status, and the code that would have switched SSH on never ran. On Windows it tried to install and start the OpenSSH server through a Unix shell that standard Windows installations do not have.

Because the malware only tried to enable SSH in one narrow condition, it left many machines with the key and the persistence but without a working tunnel. That is a smaller incident than the payload suggests and not a reassurance: the key, the persistence and the reconnaissance data still landed, and a machine that already had SSH enabled would have been reachable.

What Cursor did, and what developers should check

Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other packages and rotate access keys before reopening it. It also worked with the hosting provider to take the attacker's server offline, which cut both the reverse connections and the outbound reconnaissance. The company said its investigation found no evidence that other extension versions or its official distribution were affected.

Developers who installed the extension during the window should look for an SSH key labelled svc-telemetry in their authorized_keys file. BleepingComputer's remediation advice is to isolate affected machines, rotate accessible secrets, invalidate sessions and rebuild the environment from a known-good backup. Cursor said it would contact affected users directly, and the same outlet reported that earlier claims about npm, Open VSX and Microsoft's marketplace were later narrowed: Cursor was the only source distributing the malicious build. This site has covered a hardware hack that produced dangerous answers and Anthropic's three-tier cyber verification plan.

What is established, and what is not

Established: a malicious build with version 2.1.313 was available on Cursor's marketplace for about 11 hours on October 29; it targeted up to 5,000 users; it added an SSH key, installed persistence and sent reconnaissance data; Cursor pulled it and shut the marketplace; the other major marketplaces were not the source. Not established: how the attackers published under Anthropic's publisher identity, whether Cursor's or Anthropic's systems were compromised to do it, and whether any attacker did get in through a machine that already ran SSH.

The lesson is about where trust sits in a modern editor. A plugin marketplace is a software supply chain with write access to developers' machines, and its review process is the only barrier between a legitimate publisher identity and a malicious update. This site's coverage of the Justice Department's questions about Nvidia's Hugging Face deal follows a different thread, but both stories turn on the same question: who controls a distribution point that other people's software depends on.

Sources & reporting limits

  1. Malicious Claude Code extension on Cursor planted SSH backdoors
  2. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Keep the thread.

Follow Industry to find related stories on your next visit.

Your next read

More Industry →
THE WEEKLY EDIT

The week, made clear.

Stories worth understanding, brought together in one weekly edition.

Share this page

Instagram, TikTok & other apps

Copy the page link, then paste it where your chosen app supports links. You choose whether to send or publish.