Fake Claude Code Extension on Cursor Marketplace Planted a Hidden SSH Backdoor

Researchers have disclosed that a modified version of the Claude Code extension was distributed through the Cursor Marketplace and used to install a persistent SSH backdoor. Cursor says the malicious version was not developed by Anthropic and affected at most 5,000 users. The marketplace was briefly taken down to remove the malware. Cursor says other extensions on its marketplace were not affected.

The package presented itself as anthropic.claude-code version 2.1.313, but OpenSourceMalware's Jenn Gile said its main JavaScript bundle had a malicious 66-line loader inserted before the legitimate code. Once VS Code starts and the extension's webview opens, it adds an attacker-controlled key, labelled "svc-telemetry", to the user's SSH authorized keys file. It then tries to make the machine reachable over SSH, opens a reverse tunnel to an attacker server, and sets up persistence using a scheduled task, crontab or LaunchAgent. It also sends host details to the attacker over unencrypted HTTP.

Cursor noted that enabling the local SSH service needs admin rights, which the extension lacks on most macOS and Windows machines, so attackers likely could not log in through the tunnel there. However, the key, persistence and data theft still occur, and Cursor urges affected users to follow its remediation steps regardless. As of October 30, 2026, the malicious version has been removed, and Anthropic has published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.