Cursor recently identified a significant security breach involving malicious Claude Code extension packages on their VS Code Extension Marketplace. These compromised versions were accessible for around 11 hours on October 29, 2026, targeting both Windows and macOS platforms by attempting to install an SSH backdoor to facilitate unauthorized remote access.
Details of the Malicious Extension
The security concern was linked to versions Anthropic.claude-code 2.1.312 and 2.1.313, available from approximately 2:27 a.m. to 1:35 p.m. Pacific Time. Cursor clarified that Anthropic was not behind these altered versions, providing additional details on the distribution of this malware following Cyber Security News’ initial report regarding the malicious code and its SSH access strategy.
The compromised code was designed to collect system information, including hostname, username, operating system details, and several environment variable names. This data collection did not include the values of these variables but highlighted a significant breach of privacy and security for users.
Technical Aspects of the Threat
The extension inserted an attacker-controlled SSH public key into authorized keys and attempted to enable local SSH services. It also tried to open a reverse SSH tunnel to connect the attacker’s server back to the victim’s machine. However, due to coding errors and the lack of necessary administrator rights, these remote login attempts were largely unsuccessful, especially on Windows and macOS systems.
In terms of persistence, the payload utilized different methods for each operating system. On macOS, it employed a LaunchAgent named com.apple.sysmond, while on Windows, it attempted to create a scheduled task named SysMon, using a Startup-folder script as a fallback. These scripts aimed to re-establish the connection every 60 seconds.
Response and Mitigation Measures
Upon discovering the breach, Cursor swiftly removed the malicious packages, halted further distribution, and temporarily shut down the marketplace to prevent further incidents. An audit was performed, keys were rotated, and the marketplace was rebuilt and restored. Cursor confirmed that no other extensions were compromised.
The company collaborated with their hosting provider to disable the attacker’s server, ensuring that the reverse connections and data uploads were no longer operational. Cursor’s notification emphasized that no evidence suggested other versions of Claude Code or official distributions were affected. They provided specific indicators for detection, including IP addresses and connection ports, to aid cybersecurity teams in identifying affected systems.
Cursor advises isolating any compromised hosts and performing thorough clean-up procedures, as merely removing the extension may not eliminate all malicious elements. They recommend rotating credentials and sessions from a secure environment and evaluating whether affected systems require a complete rebuild.
