# A backdoored Claude Code extension shipped under Anthropic's real ID via Cursor's marketplace

URL: https://www.thedeepfeed.ai/posts/2026-10-31-claude-code-extension-backdoor/
Category: Agents
Published: 2026-10-31
Author: the-deep-feed
Tags: security, supply-chain, cursor, anthropic, claude-code, coding-agents, extensions
Kind: news

> For about 11 hours on October 29, Cursor's extension marketplace served a trojanized Claude Code extension under Anthropic's real publisher ID to up to 5,000 users, which means the usual advice to check the publisher could not have caught it.

## TL;DR

- Between **2:27am and 1:35pm PT on October 29**, Cursor's VS Code Extension Marketplace served Anthropic.claude-code versions **2.1.312 and 2.1.313** for Windows and macOS with a malicious loader that Anthropic did not write.
- The payload sent host details to the attacker, added an SSH key labeled **svc-telemetry** and installed persistence. The step that would have let the attacker log in failed on most machines because it needs **admin rights**.
- Cursor says **at most 5,000 users** were affected. It shut down and rebuilt its marketplace and rotated keys. Anthropic shipped a clean **2.1.314** to Open VSX and Microsoft's marketplace, which were not affected.
- The package carried Anthropic's **real extension ID**, so checking the publisher name would not have caught it. How the attacker published under that ID has not been explained.

A backdoored build of Anthropic's Claude Code extension sat in Cursor's extension marketplace for about 11 hours on October 29 under Anthropic's genuine publisher ID, and Cursor says it reached at most 5,000 users. The attack involved no lookalike name and no fake publisher, so the standard developer advice, check who published the extension, could not have stopped it.

# What shipped, and when

Cursor's [security notice](https://cursor.com/blog/claude-code-extension-security-notice) gives the window: "Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace." An update posted at 11:30am PT on October 30 named the affected builds as "Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS" and added that "These malicious versions of the extension were not developed by Anthropic."

Researchers at [OpenSourceMalware](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) found that the package "identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code." In other words, the extension still worked as Claude Code. The extra code ran alongside it.

The payload, as Cursor describes it, collected the hostname, username, operating system, home directory, environment variable names, working directories, configured Git email and public IP, and reported them to the attacker. It then tried to "add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel," and to make that tunnel persistent through a LaunchAgent on macOS or a scheduled task running as SYSTEM, with a Startup-folder fallback, on Windows. Background scripts retried the tunnel "roughly every 60 seconds." [Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/), the macOS security firm that published an advisory on October 30, found the key carried the comment `svc-telemetry`, a name chosen to look like an administrative account.

# Why most machines escaped the worst of it

The attack was partly broken. Turning on the local SSH service "requires admin rights, which the malicious extension does not have on most macOS and Windows hosts," Cursor writes. "On those hosts the step fails and the attacker could not have logged in through the tunnel." Cursor also says that outside "highly unusual circumstances where Cursor was started with administrator privileges," errors in the malicious code made that step fail.

That is not the same as harmless. "The extension added the attacker's SSH key, installed persistence, and sent host details to the attacker," the notice continues, and "Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running." Cursor tells affected users to rotate credentials and sessions reachable from the machine and to consider rebuilding it.

# What Cursor and Anthropic did

Cursor says it removed the malicious version "immediately upon detection," then took the whole marketplace down "out of an abundance of caution." It "audited access and confirmed no other extensions were tampered with," "rotated our keys, rebuilt the marketplace, and brought it back online," and worked with the hosting provider "to take the malicious server offline."

On scale, [The Hacker News](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) quoted a Cursor statement that the incident affected "at most 5,000 users." It also reported that the malicious build went out only through Cursor's marketplace, with no evidence it reached Open VSX or Microsoft's Visual Studio Code Marketplace, and that by October 30 "Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace." Early reporting was confused on this point. [BleepingComputer](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/) noted that "initial reports suggested that npm, Open VSX, and Microsoft's Visual Studio Code Marketplace were also impacted," before it "was later confirmed that Cursor was the only source."

# The publisher check failed

The detail that matters most is the identity the attacker used. Supply-chain attacks on extension stores usually depend on typosquatting or a lookalike publisher, and the defense taught to developers is to check who published the package. This one carried the real ID. The Hacker News put it directly: the attackers "distributed it as version 2.1.313 under Anthropic's legitimate Claude Code extension ID (anthropic.claude-code), rather than as a separate fake extension."

Ax Sharma, head of research at Manifold Security, drew the conclusion in comments to [Help Net Security](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/):

> Increasingly, it's agents and automatic updates installing these things, not humans. Checking the publisher name doesn't help when the publisher is real.
>
> — Ax Sharma, Head of Research, Manifold Security, via Help Net Security, Oct 30, 2026

When a listing arrives under the genuine ID, the trust a developer places in it is really trust in whoever operates the marketplace. Cursor runs its own store for the extensions its editor installs. That store, not Anthropic's distribution, is where the poisoned build appeared, and it is the one that had to be shut down and rebuilt. The Hacker News reported that "The exact method attackers used to introduce the unauthorized update remains unclear," and neither Cursor's notice nor Phorion's updated advisory explains how a build under Anthropic's ID was published there.

# Why a coding-agent extension is the target

A coding agent's extension is an attractive place to hide code. It is expected to read the repository, run commands and reach the network, so a loader that does the same draws little attention. It runs on developer machines that typically hold Git credentials, cloud tokens and SSH access to other systems. And, as Sharma noted, updates increasingly arrive automatically. The payload's choice of target, the SSH `authorized_keys` file, reflects that: the aim was standing access to a developer's machine, not the extension itself.

This publication [described in October](/posts/2026-10-16-coding-agents-pick-sides/) how coding-agent vendors and editors were choosing sides. The incident adds a security dimension to that split. A developer using Claude Code inside Cursor depends on two companies' release pipelines and on the marketplace in between. The open question from this week is the one neither company has answered: how a build under Anthropic's real ID got into Cursor's marketplace. Until that is explained, developers have no way to judge whether it could happen again.

## Sources

- [Cursor — Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (Oct 29, updated Oct 30, 2026)](https://cursor.com/blog/claude-code-extension-security-notice)
- [Phorion — Official Claude Code Extension Compromise: Security Advisory (Oct 30, updated Oct 31, 2026)](https://phorion.io/blog/offical-claude-code-vsx-compromise/)
- [OpenSourceMalware — Trojanized Claude Code Extension Plants an SSH Backdoor (Oct 30, 2026)](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor)
- [BleepingComputer — Malicious Claude Code extension on Cursor planted SSH backdoors (Oct 30, 2026)](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/)
- [The Hacker News — Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor (Oct 30, 2026)](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html)
- [Help Net Security — Claude Code extension poisoned with persistent SSH backdoor (Oct 30, 2026)](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-10-31-claude-code-extension-backdoor/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt