Cursor has disclosed that two tampered builds of the widely used Claude Code extension were distributed through its VS Code Extension Marketplace for about eleven hours on October 29, 2026, exposing Windows and macOS developers to a hidden SSH backdoor. The company stressed that Anthropic, which publishes the legitimate extension, had no role in creating the malicious builds.

A Narrow but Real Window of Exposure

According to Cursor’s security notice, the compromised packages were labeled versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension. They sat on the marketplace between roughly 2:27 a.m. and 1:35 p.m. Pacific Time — just over eleven hours — before Cursor pulled them down. The company later revised its advisory on October 30 to sharpen the list of affected versions and add further detection guidance.

The disclosure builds on earlier reporting about the same weaponized extension, which first examined the malicious loader and its SSH-based persistence mechanism. Cursor’s statement adds concrete distribution timing and scope to that earlier analysis.

What the Malicious Code Actually Did

Once installed, the tampered extension quietly fingerprinted the host machine, collecting the device’s hostname, username, operating system and processor architecture, home and working directories, the Git-configured email address, the public IP address, and the names — not the contents — of environment variables.

It then tried to go further. The code inserted an attacker-controlled SSH public key, tagged svc-telemetry, into the machine’s list of authorized keys, attempted to switch on the local SSH service, and opened a reverse tunnel so the attacker’s server could reach back into the victim’s own SSH port. On macOS, persistence relied on a disguised LaunchAgent named com.apple.sysmond; on Windows, the malware tried to register a scheduled task called SysMon running with SYSTEM privileges, falling back to a Startup-folder script if that failed. Background routines kept retrying the connection roughly every minute.

Cursor noted that bugs in the malicious code, combined with the fact that most victims weren’t running with administrator rights, blocked the SSH service from actually turning on across most Windows and macOS hosts. That stroke of luck limited how many machines could be remotely accessed — but it did not stop the reconnaissance data collection or the other changes the malware made to infected systems.

Cursor’s Response: Pull, Patch, and Rebuild

Once the tampering was confirmed, Cursor removed the malicious packages, blocked them from being republished, and temporarily took its entire marketplace offline while it investigated. The company says it audited access logs, rotated its own credentials and signing keys, rebuilt the marketplace infrastructure, and then restored service. A subsequent review found no indication that any other extensions in the catalog had been tampered with.

Cursor also coordinated with the hosting provider behind the attacker’s command infrastructure to take that server offline. As a result, the reverse SSH tunnels and the host-data upload mechanism built into the malicious extension no longer function. The company says it has found no evidence that the official, upstream distribution channel for Claude Code — or any other version of the extension — was affected.

The incident echoes a string of recent attacks aimed at trusted developer tooling, including the previously reported compromise of the Nx Console extension. While both cases involved malicious code smuggled inside widely trusted developer extensions, there is currently no public evidence tying the two campaigns to the same attacker.

What Defenders Should Check

Cursor published a set of indicators of compromise tied to the campaign, including the IP address 134[.]209[.]82[.]225, outbound SSH connections over TCP port 22, and HTTP POST traffic directed at /beacon on port 8099. Security teams are advised to:

• Search authorized_keys files across developer workstations for the svc-telemetry key fingerprint
• Review extension installation logs for the 2.1.312 and 2.1.313 builds during the exposure window
• Check endpoint and network logs for connections to the published indicators
• Isolate any host where evidence shows the payload actually executed or the backdoor was installed

Cursor cautions that simply uninstalling the extension is not enough, since separate scripts and scheduled tasks created by the malware can persist independently. The company has published platform-specific remediation steps and recommends rotating any credentials or active sessions accessible from an affected machine — ideally from a separate, trusted device — while assessing whether compromised endpoints need to be rebuilt entirely.

For organizations that rely heavily on AI coding assistants and their IDE extensions, the episode is a reminder that supply-chain risk isn’t limited to open-source package registries. Marketplace-distributed developer tools, even from well-known publishers, can be hijacked for a matter of hours and still cause lasting damage.