On this page (7 sections)
A tampered build of the Claude Code extension, published as version 2.1.313, was distributed to developers as a normal update and tried to install a persistent SSH backdoor. Cursor says the malicious version was available in its extension marketplace for about 11 hours on October 29, 2026, and that at most 5,000 users were affected (Help Net Security).
If you or your team use Cursor, Windsurf or another VS Code-compatible editor, and especially if the extension auto-updates, check your machines now. Uninstalling the extension alone may not remove the backdoor.
What happened
Researchers say the package identified itself as anthropic.claude-code version 2.1.313, the legitimate extension ID, rather than appearing as a separate fake. Jenn Gile of OpenSourceMalware said its main JavaScript bundle contained a malicious 66-line loader inserted before the legitimate code (The Hacker News). Cursor stated the version was not developed by Anthropic.
How the attackers got an unauthorized update published is not known. The Hacker News reports the method remains unclear, and the research found no original vendor advisory, so the details below rely on press reporting and statements quoted in it.
Where the sources disagree
Help Net Security says researchers at Phorion spotted version 2.1.313 on Open VSX, the Eclipse Foundation marketplace used by editors such as Cursor and Windsurf, and that no malicious version was reported on Microsoft's Visual Studio Marketplace. The Hacker News says the malicious update was distributed only through Cursor's marketplace, with no evidence it reached Open VSX or Microsoft's marketplace. This is unresolved in the available reporting. Treat any install of 2.1.313, from any VS Code-compatible marketplace, as suspect.
What the malicious code does
According to the reporting, the injected code runs as soon as Node loads the file, before the extension's normal activation, so the user does not need to interact with it (Help Net Security). It then:
- Adds an attacker-controlled key, labeled "svc-telemetry", to ~/.ssh/authorized_keys, which would let the attacker log in as that user.
- Opens an outbound SSH connection to an attacker server, creating a reverse tunnel that keeps running after the editor is closed and retries about every 60 seconds.
- Installs persistence: a LaunchAgent on macOS, a cron entry at reboot on Linux, and a scheduled task named SysMon on Windows (with a Startup folder fallback, per Help Net Security).
- Sends host details to the attacker over unencrypted HTTP: public IP, hostname, username, operating system and architecture, home and working directories, global Git email, and the names (not values) of up to 40 environment variables containing words like KEY, TOKEN, SECRET, PASS, AWS or GCP.
The Hacker News lists the attacker address as 134.209.82[.]225, with beacons sent to port 8099. No follow-on payloads have been observed. Even without values, variable names can show which cloud providers and CI systems a machine is configured for, as researcher Paul McCarty noted.
Why some machines were safer
Cursor says enabling the local SSH service needs admin rights that the extension lacks on most Mac and Windows hosts, so on those machines the attacker could not have logged in through the tunnel. Phorion cautions this is no defense: if Remote Login or an SSH server is already running, or is turned on later, the planted key is usable. The key, persistence and data reporting happen either way. Cursor also says it worked with the hosting provider to take the attacker's server offline, which stopped the tunnel and reports from working.
Who is affected
Realistically, developers who installed or auto-updated to 2.1.313 during the exposure window. Auto-update is the main risk factor: Gile noted the version was pulled quickly, but anyone with auto-update enabled could have received it. Developer machines often hold cloud credentials, API tokens, SSH keys and CI access, which is why this matters beyond one laptop.
Cursor says it has no evidence that other versions of the extension or other marketplace extensions were affected, and that it will contact impacted users directly.
How to check your machine
Start with read-only checks. This lists installed extensions and versions in editors that provide the standard command-line launcher (use cursor, code or your editor's equivalent). Look for anthropic.claude-code at 2.1.313.
cursor --list-extensions --show-versions | grep -i claudeNext, review your SSH authorized keys for any key you do not recognize, especially one labeled svc-telemetry. This only reads the file.
grep -n "svc-telemetry" ~/.ssh/authorized_keysThen check for the reported persistence. On Linux, list your crontab and look for entries you did not create. On macOS, review LaunchAgents with unfamiliar names. On Windows, look for a scheduled task named SysMon.
crontab -l
ls -l ~/Library/LaunchAgentsschtasks /query /tn SysMonFinally, check firewall or proxy logs for connections to 134.209.82[.]225 (including port 8099). A hit means the host should be treated as compromised.
What to do now
Reporting says affected users should isolate hosts, remove the unauthorized SSH key and persistence, and rotate credentials and sessions. Cursor says removal of the extension alone may not be enough because the payload drops standalone scripts that keep running.
0 of 9 done
Detection and monitoring afterwards
Keep watching for outbound SSH from developer workstations to unfamiliar hosts, new entries in authorized_keys, and new scheduled tasks or cron jobs. If developer or CI credentials were exposed, review cloud audit logs for unusual API use after October 29.
If the same credentials can reach your production sites, check those too. The Webforta Scan and free malware scanner look at sites from the outside, so they cannot see a compromised laptop, but they can help confirm nothing unexpected changed on your public sites. See also our guide on what to do if a website is hacked.
Wider context
The Hacker News notes this came a little over a week after another supply chain incident, in which release binaries of OVHcloud's official CLI were replaced with secret-stealing malware via a hijacked contributor account. Extensions run with the user's own privileges, so a poisoned update from a trusted publisher ID bypasses the usual instinct to distrust unknown packages. Treat IDE extensions like any other software dependency: limit what you install, review updates for sensitive machines, and keep credentials on developer laptops to a minimum.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.