Official Claude Code Extension on Cursor Marketplace Trojanized With Persistent SSH Backdoor Affecting Up to 5,000 Users

Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.

A trojanized version of Anthropic’s official Claude Code extension was distributed through the Cursor Marketplace, where malicious builds attempted to set up SSH backdoor access, create reverse tunnels, and collect host reconnaissance data, according to reporting by The Hacker News on 2026-10-30. Cursor’s revised notice identified versions 2.1.312 and 2.1.313 as affected, and the company estimated that at most 5,000 users were impacted (The Hacker News, 2026-10-30).

What happened

The core concern is a software supply chain compromise involving a legitimate extension identity, rather than a separate lookalike package. The malicious loader was reported to have attempted to add an attacker-controlled SSH key, enable SSH access, install platform-specific persistence, and transmit host information to attacker-controlled infrastructure (The Hacker News, 2026-10-30).

Because the extension used the official identity, the tampering could be harder for users to spot than a simple clone or typosquat. That matters in marketplaces where trust is often inferred from publisher name, extension name, or perceived legitimacy of the listing itself (The Hacker News, 2026-10-30).

What the reporting says about impact

Cursor’s estimate put the number of affected users at no more than 5,000 (The Hacker News, 2026-10-30). The reporting also notes that successful remote access depended on host privileges and SSH configuration. Even so, the malware could still create keys and persistence artifacts and transmit host details when tunnel access did not succeed (The Hacker News, 2026-10-30).

That means the operational impact may have varied across systems. The available evidence supports attempted persistence and reconnaissance, but it does not show that every affected machine necessarily granted full remote access (The Hacker News, 2026-10-30).

What was not affected

The reporting says the official Microsoft Visual Studio Marketplace and Open VSX versions were not affected. Microsoft also confirmed that the malicious version was not distributed through its marketplace or the associated npm package (The Hacker News, 2026-10-30).

Why this matters

This incident is a reminder that marketplace trust is only as strong as the integrity of the package supply chain. Even when users install an extension associated with a real product, the package delivered through a marketplace can still be altered if the distribution channel is compromised (The Hacker News, 2026-10-30).

For developers and security teams, the practical takeaway is to treat extensions and plugins as software with real privileges, not as harmless add-ons. The attempted SSH key installation and persistence mechanisms reported here are especially concerning because they point to long-lived access rather than a one-time intrusion attempt (The Hacker News, 2026-10-30).

Bottom line

The evidence indicates that tampered Claude Code extension versions 2.1.312 and 2.1.313 were pushed through the Cursor Marketplace, with attempts to establish backdoor access, persistence, and reconnaissance against host systems. Cursor placed the exposure at up to 5,000 users, while Microsoft’s marketplaces were not implicated in the distribution chain described in the reporting (The Hacker News, 2026-10-30).

Sources and dates

Research completed: 2026-11-03T05:09:00+00:00

Building your own website?

This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.