A malicious package that tampered with Anthropic's Claude Code extension was published on the extension marketplace of the AI coding editor Cursor. According to Cursor's security notice and a technical analysis by endpoint detection and response (EDR) vendor Phorion, the package contained an SSH backdoor that persisted on the machine and enabled remote access from outside. The attacker abused the same distribution slot used by the legitimate extension, so developers could have pulled in the malicious code simply by performing a routine update.
Felix Rieseberg, a member of Anthropic's technical staff, said Anthropic's systems and employee machines were not compromised. He explained that a third party abused access to Cursor's marketplace to publish the altered version. However, the malware had privilege-escalation limitations and implementation flaws, and on most machines it failed to enable the SSH service. Even when a reverse SSH tunnel to an external server was established, remote login through that tunnel could not succeed if the SSH service on the machine was not running.
That said, a failed remote login does not mean the machine was unaffected. Once loaded, the extension collected host information and sent it out, registered an unauthorized SSH public key, and ran background persistence routines. These operate independently of the extension itself, so updating or uninstalling it does not remove them. On affected machines, users need to check for rogue SSH keys and resident processes, and respond on the assumption that credentials may have been exposed.
Distribution route and the two affected versions
According to Cursor's security notice, updated on October 30, 2026, the malicious packages were versions 2.1.312 and 2.1.313 of Anthropic.claude-code. The initial notice listed only 2.1.313, but 2.1.312 was added as the investigation progressed. The distribution window lasted roughly 11 hours, from 2:27 a.m. to 1:35 p.m. Pacific Daylight Time on October 29, 2026 (9:27 a.m. to 8:35 p.m. UTC).
The malware payload analyzed by Phorion contained setup and persistence logic for macOS, Windows, and Linux. However, Cursor's official notice confirms distribution of the tampered package only for macOS and Windows. The presence of attack code for Linux does not mean a tampered Linux package was actually distributed. The operating systems the malware supports must be distinguished from those where distribution was confirmed.
Because the affected versions have also changed since the initial announcement, impact assessments should use Cursor's notice updated on October 30 as the baseline. If tampered packages for other platforms or additional altered versions are identified later, the scope of investigation will need to be revisited. Phorion's analysis is useful for understanding how the attack code behaves, but the actual distribution scope and remediation steps should be checked against Cursor's official information.
| Item | Cursor Marketplace distribution | Anthropic official channels | What to check |
|---|---|---|---|
| Distributed package | Tampered versions 2.1.312 and 2.1.313 | No distribution of the same tampered versions confirmed | Cursor's updated security notice |
| OS with confirmed distribution | macOS, Windows | No impact reported from this incident | Attack code for Linux also exists, but distribution was confirmed for only two OSes |
| Distribution window | About 11 hours on October 29, 2026 | Not applicable | 02:27–13:35 PDT |
| Publishing permission | Used by a third party for unauthorized publishing | Anthropic denies compromise of internal systems and devices | Felix Rieseberg's explanation |
| Persistence of the threat | Persistence files may remain after the extension is removed | Not applicable | Scripts registered via LaunchAgent or startup folders |
Rieseberg said the tampered version was neither built nor published by Anthropic, and that packages distributed through the company's official channels, such as npm and Microsoft's VS Code Marketplace, were not affected. Cursor removed the offending package from its marketplace and temporarily suspended the entire extension marketplace to prevent further unauthorized distribution. Developers should check where they obtained the Claude Code extension, when it was installed or updated, and which version they have.
An SSH backdoor that runs as soon as the extension loads
Phorion's technical analysis shows that the attacker inserted malicious code in the form of an immediately invoked function expression (IIFE) at the top of extension.js, a file that makes up the legitimate extension's code. In VS Code and Cursor extensions, an activate callback normally runs when triggered by something like a user action, but this IIFE is evaluated the moment Node.js loads the file. In other words, the backdoor setup began merely from the extension code being loaded, even if the user never interacted with any Claude Code feature.
The malicious code first modifies the machine's SSH authentication settings and attempts to establish a reverse SSH tunnel to an external server. It then runs OS-specific persistence routines and sends collected machine information to the attacker's server. These processes are independent of the extension's normal behavior and were designed to keep communicating even after the editor is closed.
To modify the SSH authentication settings, the malware appends an Ed25519 public key controlled by the attacker to the victim's ~/.ssh/authorized_keys file. The key carried the comment svc-telemetry, which resembles a credential for system monitoring. An attacker holding the corresponding private key could log in as that user without a password, provided the SSH service was running on the machine.
Next, using a separate private key embedded in the malware, it opens a reverse SSH tunnel to an attacker-controlled external server. The victim machine makes an SSH connection out to the external server, and traffic to a port assigned on that server is forwarded to local port 22 on the victim machine. Through the forwarded port on the external server, the attacker can reach the SSH service of machines that are not directly reachable from the internet. The tunnel connection was detached as a background process and was designed to retry at roughly 60-second intervals if it failed.
OS-specific persistence routines were also prepared so the connection would survive a reboot. On macOS, a configuration file is placed in a user-level LaunchAgent so the backdoor starts at login. On Windows, the malware attempts to register a SYSTEM-privilege task through Task Scheduler, and if that fails for lack of privileges, it places a script in the current user's Startup folder. In both cases, these mechanisms can remain after the extension itself is deleted.
The information collected included the hostname, login username, OS type and architecture, home and current directory paths, the email address registered in Git settings, and the public IP address. It also extracted up to 40 environment variables whose names contained strings such as KEY, TOKEN, SECRET, PASS, AWS, or GCP.
According to Phorion, what was collected were the names of the environment variables, not their values. Still, variable names can reveal which cloud services and types of credentials are in use, giving an attacker material for prioritizing targets. And if remote login through the SSH backdoor succeeded, tokens and key material stored in environment variables could also be accessible.
The collected information was sent to the attacker's server via HTTP POST requests. In addition to machine information, the transmission included the status of SSH key registration and persistence execution, allowing the attacker to track how far preparations for entering each machine had progressed.
Implementation mistakes that blocked remote intrusion, and the remaining risk
The malware contained a multi-stage SSH-based intrusion routine, but due to implementation flaws and insufficient privileges, it failed to meet the conditions required for remote login in many typical environments. On macOS in particular, there was a problem with the process for enabling the SSH service.
On macOS, "Remote Login," which accepts incoming SSH connections, is usually disabled. The malware was designed to check the setting with the systemsetup -getremotelogin command and run an enabling command if the output contained Off. However, when this check command is run with standard user privileges, it returns a message saying administrator privileges are required rather than the setting's status. That message does not contain Off, so the malware exits without attempting to enable the SSH service.
Even if this check had worked correctly, enabling Remote Login with systemsetup requires administrator privileges. The malware has no function to escalate privileges by exploiting OS vulnerabilities and normally runs with the privileges of the user who launched the editor. As a result, on machines without administrator privileges, it could not newly enable the SSH service.
The situation differs, however, on macOS machines where Remote Login was already enabled. If the attacker's public key is registered in authorized_keys, there is no need to newly enable the SSH service. If a user enables the SSH service after infection, the remaining public key could also allow unauthorized login. Likewise, even if an outbound reverse SSH tunnel is established, remote login cannot succeed unless an SSH service is listening on local port 22, but on machines where the service is running, it can serve as an entry point.
The Windows implementation also had a defect. In the helper routine that uses PowerShell to configure and start the Windows OpenSSH server (sshd) service, the command execution target was hard-coded to /bin/sh. That path does not exist in a standard Windows environment, so the SSH service setup fails. In addition, the routine that registers a SYSTEM-privilege scheduled task cannot run with ordinary user privileges.
Cursor says it worked with the cloud provider hosting the attacker's servers to take them down. As a result, reverse SSH connections to the reported attack servers and the transmission of machine information no longer function.
Even on machines where enabling the SSH service failed, however, information such as the hostname, username, public IP address, and Git email address may have been sent out. And if rogue public keys or persistence scripts remain, an intrusion could still occur if the machine's SSH settings are changed later. The takedown of the attacker's servers does not mean the backdoor left on a machine has been removed.
Even if remote login did not succeed, updating the extension is not enough. Infected machines may retain rogue SSH keys and resident scripts, each of which must be identified and deleted. On machines where the SSH service was running, authentication logs and network records should be examined to determine whether logins actually occurred, and to check for access to credentials or lateral movement into the internal network.
What developers should investigate and how to remove the backdoor
Developers and organizations that may have installed or updated the Claude Code extension from Cursor's marketplace during the affected window should not only update the extension to the latest version but also investigate malicious files and processes left on their machines. Because the malware writes independent scripts to the OS startup areas, the backdoor may remain even after the extension is uninstalled.
Cursor recommends confirming impact, isolating the machine, removing the backdoor, and rotating credentials. First, identify machines that installed Anthropic.claude-code 2.1.312 or 2.1.313 in a macOS or Windows Cursor environment during the relevant window on October 29, 2026. In addition to the displayed version, it is advisable to cross-check the extension's install time, update logs, and the hash values of the actual files. Machines showing traces of malicious code execution or backdoor installation should be isolated from the network while the investigation proceeds.
To check for signs of infection, examine SSH authentication files, persistence settings, running processes, and network communication records. Cursor's security notice includes steps for checking whether ~/.ssh/authorized_keys contains the string svc-telemetry. However, Phorion recommends matching the SSH public key's fingerprint itself rather than relying only on the comment name. This malware also used the comment string to avoid registering the public key twice, so matching the key itself is better for accurate identification.
To remove the backdoor, you can use the official platform-specific remediation scripts published by Cursor. The required privileges differ by OS, however. On macOS, persistence files are created under the user's home directory, so the script must be run from the affected user's account, not as root. On Windows, the remediation script is specified to be run from a PowerShell session launched as administrator.
The main items to check and delete are as follows.
macOS
- Rogue public key entries in
~/.ssh/authorized_keys - The autostart setting registered at
~/Library/LaunchAgents/com.apple.sysmond.plist - Persistence scripts and key files such as
~/.config/.smtand~/.config/.smtk - Private key files beginning with
.stk_created in temporary directories
- Rogue public key entries in
Windows
- Rogue public key entries in
%USERPROFILE%\.ssh\authorized_keys - Rogue public key entries in
C:\ProgramData\ssh\administrators_authorized_keys - The
SysMontask registered in Task Scheduler - Persistence files such as
%USERPROFILE%\.config\smt.cmdand%USERPROFILE%\.config\smtk - Startup scripts such as
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd
- Rogue public key entries in
In addition to deleting files, you must stop any running reverse SSH tunnels and reconnection processes. On macOS in particular, it is important not only to delete the LaunchAgent configuration file but also to stop the registered job. On Windows, check the status of scheduled tasks and startup registrations, and verify that the backdoor does not return after a reboot. Depending on the extent of infection, you may also need to consider wiping the machine or rebuilding it from a trusted image.
After removing the backdoor, investigate the possibility that credentials were exposed. Machine information was sent to the attacker, and in environments where the SSH service was running, the possibility of remote login cannot be entirely ruled out. For GitHub and GitLab access tokens, cloud credentials such as AWS and Google Cloud, database connection details, SSH private keys, and anything else that was available from the affected machine, check access history and the possibility of exposure.
Credentials that may have been compromised should be revoked and reissued from a separate, trusted machine. In particular, for machines where the SSH service was enabled or where there are traces of suspicious logins or file access, assume that the credentials accessible from them have been exposed. Revoke existing tokens and sessions, and review authentication logs and cloud service activity history to verify that no unauthorized use is continuing.
Abuse of publishing permissions and an intrusion route that remains unexplained
In this attack, rather than publishing a new fake package with a name resembling the legitimate extension, the attacker abused the distribution slot of the existing Claude Code extension in Cursor's marketplace. Because the malicious update was delivered under the official extension name that developers trust, checking the publisher name or extension identifier alone was not enough to spot the tampering.
Known software supply chain attacks include typosquatting, which uses names resembling legitimate packages, and takeovers of abandoned repositories. In this case, unlike those, the malicious version was delivered through the distribution route corresponding to the legitimate extension. Simply by applying an update shown in the editor as usual, a user could have let the attack code into their development environment.
Cursor acknowledges that the package was distributed through its own VS Code extension marketplace and says it was not developed by Anthropic. Anthropic's Felix Rieseberg likewise said the attacker abused access to Cursor's marketplace, and denied any compromise of the company's internal systems or employee machines.
After detecting the package, Cursor removed it and blocked the unauthorized distribution, then suspended the entire marketplace and conducted an audit. It says no similar tampering was found in other extensions. It also rotated related keys, rebuilt the marketplace infrastructure, and restored the service. It also says it has found no evidence that other versions or Anthropic's official distribution channels were affected.
Cursor has not, however, disclosed in detail how the attacker obtained the permissions to overwrite and publish the legitimate extension. It is unclear whether a publishing authentication token leaked, whether there was a problem in developer account management, or whether there was a flaw in the marketplace infrastructure's authentication and authorization mechanisms. Unless the initial intrusion route is identified, it is impossible to judge how well a recurrence using the same method can be prevented.
As AI agents and coding assistants spread, IDE extensions have gained broad access to developers' source code, credentials, and local execution environments. On development machines where corporate source code and cloud service API keys are concentrated, a compromised extension can become a security risk for the entire organization.
In this incident, implementation mistakes in the malware prevented remote login on many machines, but the transmission of environment information and the persistence routines were still carried out. Ensuring the safety of extensions requires more than checks by users: it calls for management of marketplace publishing permissions, integrity verification of distributed artifacts, and mechanisms to detect unauthorized updates. The focus now is on how much Cursor will disclose about how the attacker obtained publishing permissions and what measures it will take to prevent a recurrence.