Claude Code for Cursor: version 2.1.313 shipped an SSH backdoor

On 29 October 2026, for about 11 hours, Cursor’s VS Code extension marketplace distributed a tampered version of Anthropic’s Claude Code extension, 2.1.313. According to Cursor’s notice, as reported by BleepingComputer, the window ran from 2:27 a.m. to 1:35 p.m. Pacific Time (roughly 10:27 to 21:35 CET), and at most 5,000 users were affected; the company will contact them directly. The malicious code tries to install a persistent SSH backdoor and sends host reconnaissance to the attacker.

Cursor states that the malicious version was not developed by Anthropic and that it has no evidence that other versions of the extension or the official distribution were affected. How the attacker managed to publish the package under Anthropic’s name has not been explained.

Where it was distributed

The sources initially diverged. Help Net Security wrote that security firm Phorion had found the package on Open VSX, the Eclipse Foundation marketplace used by editors built on VS Code; in an update, however, it reports that Ax Sharma of Manifold Security disputes that the Open VSX version was compromised. According to BleepingComputer, early reports also mentioned npm, Open VSX and Microsoft’s Visual Studio Marketplace, but it was later confirmed that Cursor’s marketplace was the only source.

Technical details

The analysis comes from Phorion and OpenSourceMalware. An immediately invoked function expression (IIFE) was prepended to extension.js, the extension’s minified bundle; the rest of the code is the legitimate one. The injected prefix loads the Node.js modules child_process, fs, os, path, http and crypto and runs as soon as the editor loads the file, before the normal activate function: the user does not have to use Claude Code at all.

Once running, it:

• adds an attacker SSH key to the user’s authorized_keys file, labelled svc-telemetry, and tries to enable the SSH service;
• opens an outbound SSH connection to the attacker’s server, creating a reverse tunnel the operator can use to reach the machine; the tunnel keeps running after the editor is closed and retries about every 60 seconds;
• sets up persistence: on macOS with a LaunchAgent with an Apple-style name, on Linux with a cron entry that runs at boot, on Windows with a scheduled task called SysMon or, if that fails, a file in the Startup folder;
• sends to 134.209.82[.]225 the hostname, username, operating system, home and working directories, Git email, public IP and backdoor status, plus the names (not the values) of up to 40 environment variables that look like keys, tokens, passwords or AWS and GCP credentials.

The script does not steal credentials directly: according to BleepingComputer the intent appears to be retrieving them manually after logging in through the tunnel, and according to Phorion the list of variables tells the operator which hosts to go after first.

Bugs that limit the damage. On macOS the malware queries Remote Login with systemsetup -getremotelogin without administrator rights, gets an error instead of “Off” and skips enabling SSH. On Windows it tries to install the OpenSSH server with PowerShell via /bin/sh, which does not exist on standard systems. According to Cursor, enabling SSH requires admin rights the extension lacks on most Macs and Windows PCs. The sources describe no such bugs for Linux. Where the SSH service was already running, or is turned on later, the backdoor works: Phorion warns that the bug is no defence.

Cursor’s response. It pulled the version, shut down the marketplace as a precaution, audited access without finding other tampered extensions, rotated its keys and rebuilt the service before reopening it. Working with the cloud provider, it took the attacker’s server offline, cutting off both the tunnel and the data reports.

In our reading the relevant MITRE ATT&CK techniques are T1195.002 (Compromise Software Supply Chain), T1098.004 (SSH Authorized Keys), T1572 (Protocol Tunneling), T1543.001 (Launch Agent), T1053.003 (Cron), T1053.005 (Scheduled Task) and T1082 (System Information Discovery).

Impact for European and Italian companies

Developer workstations have access to repositories, pipelines and cloud environments: interactive SSH access to one of them is a privileged entry point. As Ax Sharma of Manifold Security notes, checking the publisher does not help when the package appears under the legitimate name, and increasingly it is agents and automatic updates, not people, that install extensions: behaviour is what needs watching, since a coding extension that writes SSH keys should be caught within seconds.

For NIS2 entities, supply chain security is a mandatory measure: an installation of 2.1.313 on workstations with access to relevant systems should be assessed as a possible incident, depending on what the operator could reach. Username, Git email and IP address sent to the attacker are employees’ personal data, so the GDPR notification obligation should be assessed too.

What to do now

1. Identify who uses Cursor with the Claude Code extension and who installed or updated to 2.1.313 on 29 October: removing the extension does not remove the backdoor, because the scripts keep running.
2. Check authorized_keys for the svc-telemetry key, and look for persistence: new LaunchAgents with Apple-style names, cron entries at boot, a SysMon scheduled task, files in the Startup folder. Cursor has published check commands and cleanup scripts for macOS and Windows; Cursor and Phorion have shared indicators of compromise.
3. Search the logs: network connections to 134.209.82[.]225 and outbound SSH from workstations; in SSH logs, as Phorion suggests, logins from localhost using the svc-telemetry key, the sign that an operator got in.
4. If you find traces, isolate the machine, consider rebuilding it and, from a trusted system, rotate the credentials and sessions it could reach, starting with those of the listed environment variables.
5. Harden: SSH off on workstations that do not need it, outbound SSH allowed only to known destinations, controlled extension updates in development environments.

How ARXDOME helps

With its agent, ARX Sentry collects the software and process inventory of Windows, Linux and macOS computers and servers and checks file integrity in chosen folders, such as .ssh and the LaunchAgent folders: it helps find the affected machines and spot new keys and startup files. Events are grouped into families such as persistence and suspicious executions. If a workstation is compromised, ARX Shield lets you isolate it from the network until it is rebuilt.

Last updated: 30 October 2026