Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.

A malicious version of Anthropic’s official Claude Code extension was distributed through the Cursor Marketplace on October 29, 2026, in a supply chain incident that appears to have affected about 5,000 users, according to The Hacker News on 2026-10-30. The trojanized package installed a persistent SSH backdoor and tried to collect developer credentials and environment variables, making it a notable reminder that trusted software channels can still be abused when a package is compromised.

What happened

The malicious release was version 2.1.313 of the Claude Code extension. The Hacker News reported on 2026-10-30 that the compromised package was distributed via the Cursor Marketplace between 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The report says the extension contained a 66-line JavaScript loader inserted before the legitimate code.

That loader reportedly added an attacker-controlled SSH key labeled svc-telemetry to the user’s ~/.ssh/authorized_keys file and created a reverse tunnel to the IP address 134.209.82.225, giving the attacker a persistent access path if the host remained exposed.

What the malware tried to do

According to The Hacker News on 2026-10-30, the malicious extension also tried to establish persistence through scheduled tasks, crontab entries, and LaunchAgents. It reportedly collected host reconnaissance data including public IP addresses, system architecture, directory paths, and environment variable names tied to secrets or keys such as AWS, GCP, and tokens.

Those findings suggest the goal was not just access, but also discovery of sensitive developer environment details that could be useful for further intrusion or credential theft. The source does not state whether the attacker successfully exfiltrated all of the targeted data.

Scope of the incident

The compromise was described as isolated to the Cursor Marketplace. The Hacker News reported on 2026-10-30 that Microsoft’s VS Code Marketplace and Open VSX were not affected, and Anthropic confirmed its own systems were not compromised.

Cursor responded by disabling the marketplace, removing the malicious package, rotating keys, and advising affected users to isolate impacted hosts, remove the unauthorized SSH key, and rotate credentials, according to the same report.

Why this matters

This incident is a reminder that developer tooling can become a high-value target. When an official extension is trojanized, the damage can extend beyond a single application to the broader environments developers use for code, cloud access, and secrets management.

In this case, the malware’s focus on SSH persistence and environment variables is especially concerning because those are common building blocks of modern development and deployment workflows.

Bottom line

Based on the available reporting, the compromise was a marketplace-side supply chain attack that affected users of the Cursor Marketplace rather than Anthropic’s own systems. The facts available so far point to a malicious extension that sought durable access and sensitive environment data, while the full downstream impact on individual users remains uncertain.

Source: The Hacker News, “Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor” (2026-10-30) — https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

Sources and dates

Research completed: 2026-11-01T05:17:03Z

Building your own website?

This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.