Malicious Claude Code Extension Exposes 5,000 Developers to SSH Backdoors

A malicious version of Anthropic’s Claude Code extension appeared on Cursor’s extension marketplace on October 29, 2026, potentially exposing up to 5,000 developers to an SSH backdoor.

According to Cursor’s security advisory, the compromised extension attempted to establish persistent remote access to affected computers. The malicious package, version 2.1.313, remained available for approximately 11 hours, from 2:27 a.m. to 1:35 p.m. Pacific Time.

Cursor confirmed that Anthropic did not create the malicious extension. However, the company has not explained how attackers managed to distribute it under Anthropic’s name.

Malicious Claude Code extension attempted to install SSH backdoors

Security researchers at Phorion and OpenSourceMalware discovered malicious JavaScript inside the extension’s extension.js file.

The code executed automatically when developers loaded the extension, requiring no additional interaction.

Once active, the malware collected system information, including usernames, hostnames, public IP addresses, and Git email addresses. It also attempted to install an attacker-controlled SSH key and establish a reverse SSH tunnel to a remote server.

To maintain access, the attackers used macOS LaunchAgents or Windows scheduled tasks and Startup scripts. The malware also attempted to reconnect to the attacker’s infrastructure approximately every minute.

However, researchers identified coding errors that limited the attack’s effectiveness.

On many Windows and macOS systems, the malware could not establish remote access because its reverse SSH tunnel depended on an SSH server already running on the affected computer.

Despite these limitations, the malicious extension could still install SSH keys, establish persistence, and transmit system information.

Researchers also found that the malware identified environment variables associated with sensitive credentials but did not directly extract their values.

Cursor removed the malicious extension and shut down its marketplace

Following the discovery, Cursor removed the compromised extension and temporarily shut down its entire extension marketplace.

The company also audited other marketplace extensions, rotated access keys, and worked with the hosting provider to take the attacker’s server offline.

Cursor reported no evidence that attackers compromised other versions of Claude Code or its official distribution channels.

However, questions remain about how the malicious package reached the marketplace under Anthropic’s name and whether attackers gained access to either company’s systems.

Developers should check for the svc-telemetry SSH key

Developers who installed Claude Code version 2.1.313 through Cursor on October 29 should inspect their systems for signs of compromise.

Cursor specifically recommends checking for the svc-telemetry SSH key, which could indicate that the malicious extension modified the system’s SSH configuration.

For potentially compromised devices, Cursor recommends isolating the system, rotating accessible passwords and API keys, invalidating active sessions, and rebuilding the environment from trusted backups.

The investigation has not established how many of the potentially exposed developers experienced a successful compromise.

In other Anthropic news, the company recently restricted Claude Code from recreating existing games, prompting complaints from developers whose legitimate projects were also affected.

Anthropic also renamed its Claude Max 5x and 20x plans and filed for an IPO amid significant financial losses.