Cursor confirmed that a malicious Claude Code extension was distributed through its marketplace for roughly 11 hours on October 29, 2026, potentially reaching up to 5,000 users. The package executed malicious JavaScript when loaded and attempted to establish persistent SSH access to developers’ machines, according to BleepingComputer’s October 30 report.
The initial warning identified version 2.1.313. A subsequent update to Phorion’s technical advisory, dated October 31, says Cursor’s security notice identifies both 2.1.312 and 2.1.313, distributed through the Cursor Marketplace for macOS and Windows, as affected.
Anthropic staff said the malicious packages were neither built nor published by Anthropic and that its systems and official distribution channels were unaffected. Developers who received an affected package through Cursor still need to investigate: coding errors limited the backdoor’s operation on some systems, but did not prevent malicious code execution or the creation of persistence artifacts.
Which Versions and Marketplace Were Affected?
The confirmed distribution channel was Cursor’s extension marketplace. Early reporting incorrectly implicated Open VSX; later reporting narrowed the incident to Cursor. There is no confirmed impact on Microsoft’s Visual Studio Code Marketplace, Open VSX or npm in the supplied reporting.
The scope needs a little care because the guidance changed after the initial disclosure:
| Detail | Published evidence |
|---|---|
| Initially identified version | Claude Code extension 2.1.313 |
| Updated affected versions | 2.1.312 and 2.1.313, according to Phorion’s October 31 update citing Cursor’s notice |
| Exposure window | Approximately 09:27–20:35 UTC on October 29, 2026, reported for 2.1.313 |
| Potential reach | Cursor estimated up to 5,000 users |
| Confirmed affected packages | macOS and Windows; the malware also contains Linux-specific logic |
| Unaffected distribution channels | Anthropic’s official channels, according to Anthropic staff |
Sophos gives the UTC exposure window, while Phorion’s updated advisory provides the expanded version guidance. The initial window and user estimate should not automatically be treated as a separately verified accounting of version 2.1.312.
The 5,000 figure is Cursor’s upper-bound estimate, not an independently verified count of successful compromises. Downloading the package, executing its payload and allowing an attacker to connect are different events.
For incident response, I’d use the updated two-version scope when searching device inventories. Restricting a search to the version named in the first news reports could miss systems covered by the later notice.
How the Extension Installed Its Backdoor
Phorion found an injected JavaScript function at the beginning of the extension’s extension.js bundle. The legitimate-looking extension code remained behind it.
The injected function ran as soon as Node.js loaded the file, before the extension’s normal activate callback. Users did not need to submit a Claude prompt or interact with the assistant to trigger it. As Phorion explains, extensions execute with the permissions of the editor and the account running it, giving malicious extension code access to that user’s files and development environment.
The payload then attempted several connected actions:
- Add an SSH authentication key. It created
~/.sshif necessary and appended an attacker-controlled Ed25519 public key to~/.ssh/authorized_keys. - Enable an SSH server. Platform-specific routines attempted to start or install the service needed to accept SSH connections.
- Create a reverse SSH tunnel. The malware attempted an outbound connection to attacker infrastructure at
134.209.82[.]225. - Maintain persistence. Reported mechanisms included a macOS LaunchAgent and a Windows scheduled task or Startup script.
- Report host information. The payload sent reconnaissance data and backdoor status to the attacker.
The SSH key carried the comment svc-telemetry. The script checked for that text before appending the key, rather than comparing the actual public key. That makes the comment a useful search indicator, but a responder should inspect the key material or its fingerprint instead of treating the label alone as conclusive.
The distinction between the key and the tunnel matters. The key supplies an authentication method for whoever holds the matching private key. The reverse tunnel supplies a network path back toward the victim’s SSH service. If that service is unavailable, the intended interactive access fails, even though the key and persistence can remain.
BleepingComputer reports that the persistence retried the tunnel roughly every minute. The collected information included usernames, hostnames, public IP addresses, Git email addresses and names of environment variables associated with sensitive credentials. Its account says the script did not directly steal credential values. That observation concerns the analyzed payload; it cannot establish what an attacker might have accessed through a working remote connection.
Why the Coding Errors Reduced the Impact
The malware’s SSH setup had platform-specific defects. These explain why an installed payload did not necessarily produce a usable remote backdoor.
macOS: The Remote Login Check Could Skip Enablement
On macOS, the payload ran systemsetup -getremotelogin without elevated privileges. It expected output containing Off, which would trigger an attempt to enable Remote Login using non-interactive sudo.
Phorion found that a standard-user invocation instead produced an administrator-access error. Because the output did not contain Off, the malware skipped the enablement step.
A Mac with SSH disabled could therefore receive the attacker’s key and persistence without gaining a working SSH server. A Mac where Remote Login was already enabled would not receive the same protection from that particular bug.
Windows: The Setup Routine Expected a Unix Shell
The Windows path tried to install and start OpenSSH Server through PowerShell, but passed that operation through a helper hardcoded to use /bin/sh. A standard Windows installation does not provide that Unix shell, so the setup attempt could fail.
Phorion also describes Linux routines that try systemctl, then older service-management commands. The presence of Linux code in the implant should not be confused with confirmation that a Linux package was distributed in this incident.
None of the analyzed service-enablement routines included a privilege-escalation exploit. Their success depended on the host’s configuration and available permissions, according to Phorion’s analysis.
The practical distinction is between payload execution and successful remote access. An already-running SSH service is especially relevant when assessing whether the attacker’s intended access path could work. Missing or disabled SSH may limit that path, but it does not erase the execution, reconnaissance or persistence that happened beforehand.
I would prioritize hosts with SSH already enabled for deeper access investigation, while keeping every confirmed payload execution inside the cleanup scope.
What Affected Developers Should Do Now
Sophos explicitly warns that uninstalling the extension leaves the backdoor components behind. Removing an extension from the editor is not equivalent to undoing changes it made elsewhere on the machine.
A practical response should cover the following steps.
-
Identify potentially exposed machines. Find Cursor installations and check available inventory, package and installation records for Claude Code extension versions 2.1.312 and 2.1.313. Use October 29’s 09:27–20:35 UTC window as the documented initial exposure period, with the version-scope caveat above. A current clean version alone cannot rule out earlier execution.
-
Isolate systems with confirmed indicators. BleepingComputer recommends isolation for impacted machines. In an organization, involve the incident-response team before deleting artifacts so the investigation can retain useful evidence.
-
Inspect SSH authorization. Look for the attacker-controlled entry in the affected user’s , including the comment. Remove the malicious entry through a controlled cleanup process. Deleting the entire file can also remove legitimate access keys, so distinguish the attacker’s addition from authorized entries.
Frequently Asked Questions
3 questions
1Which Claude Code Versions Should I Check?
Check 2.1.312 and 2.1.313 from Cursor’s marketplace. Initial reports named only 2.1.313; Phorion’s October 31 update expanded the affected-version guidance.
