Cursor Distributed Claude Code Extensions With SSH Backdoor Code

Listen to this article

Press play to start listening

Developers installingClaude Codethrough Cursor’s extension marketplace were offered tampered packages designed to collect information about their computers and give attackers remote access. Cursor removed the malicious downloads but warned that deleting the extension alone will not remove the files it left behind.

The company published its security notice on October 29, 2026, then updated it on October 30 to identify two affected versions, 2.1.312 and 2.1.313, for Windows and macOS. The packages were available between approximately 2.27 am and 1.35 pm Pacific Daylight Time on October 29, equivalent to 9.27 am to 8.35 pm GMT

OpenSourceMalware’sanalysisof version 2.1.313 found a 66-line malicious loader inserted before the extension’s normal JavaScript code. The package retained the legitimate extension identityanthropic.claude-code, and included the genuine bundled binary.

The malicious loader executed before the extension’s normal code. OpenSourceMalware reported that it ran when the extension activated after startup or when its webview opened. The researchers identified the alteredextension.jsfile as the difference from the normal package.

Microsoft’sseparate investigationconfirmed that the malicious packages were not distributed through its Visual Studio Marketplace or the Claude Code npm package. Anthropic also told Microsoft that its systems had not been compromised and that it had not developed the malicious package.

Once running, the loader gathered information about the host and user before attempting to add an attacker-controlled SSH key, enableSSHand create a reverse tunnel. Such a tunnel can provide a connection from an affected computer to an external server, allowing remote access when the necessary services and permissions are available.

Cursorsaid coding errors and administrator-permission requirements blocked the SSH access step on most Windows and macOS computers. However, the package could still leave tvflcf an unauthorised key, startup files, and transmitted device information. A failed tunnel therefore did not mean the installation required no cleanup.

Microsoft also identified startup mechanisms outside the extension’s installation directory. These included a macOS LaunchAgent, a Windows scheduled task namedSysMonand a fallback script in the Windows Startup folder. Its analysis distinguishes what the code attempted from what investigators could confirm had succeeded on an individual computer.

Cursor temporarily closed the marketplace, rotated keys and rebuilt it before restoring service. It also worked with the hosting provider to take the attacker’s server offline.

Affected users should follow the detection and remediation instructions in theofficial notice, remove the unauthorised SSH key and persistence files, and rotate accessible credentials from a trusted computer. Cursor provides separate cleanup scripts for Windows and macOS and advises assessing whether affected computers need to be rebuilt.

Editor’s note:Cursor’s initial notice said at most 5,000 users were affected. That figure has since been removed, and the updated notice identifies version 2.1.312 alongside 2.1.313. The original notice is available through theInternet Archive.

Your email address will not be published.Required fields are marked*

Comment*

Name*

Email*

Website

Δ

Email Address*

FIRSTNAME

LASTNAME