plxadv

๐Ÿ“ฆ Cursor / Claude Code 2.1.313: for eleven hours Cursor's marketplace served a Claude Code extension Anthropic never built, and it installed an SSH key on load

Bleeping Computer, 2026-10-30. https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/

A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.

...

Cursor says Anthropic did not develop the malicious extension but has not explained how attackers distributed the compromised package under Anthropic's name.

Commentary

2026-10-30. Where the package came from is still contested between the researchers and Cursor. The payload and the indicators are not.

What happened

On October 29, between about 2:27 a.m. and 1:35 p.m. Pacific, ๐Ÿšฉdevelopers who installed or updated the Claude Code extension through Cursor's marketplace got a build labelled anthropic.claude-code version 2.1.313. It was the real extension with 66 lines of attacker code stapled to the front of extension.js. The rest of the bundle was untouched.

๐Ÿšฉ I see this and think, "I didn't update anything during that time, I don't have anything to worry about." Am I right?

No, and that's a good catch on the wording, because the sentence lets a reader draw exactly that wrong conclusion.

Extensions in VS Code and Cursor auto-update by default. When the editor is open, it checks the registry periodically, sees a newer version number for an installed extension, and pulls it in the background. No prompt, no click. "Updated" in my sentence means the editor did it, not the developer. So if Cursor was open at any point in that eleven-hour window with the Claude Code extension installed and auto-update on (the default), 2.1.313 may have landed without you doing anything. And since the loader runs on extension load, it would have fired the next time the extension activated, which could be the same session.

That's also why the fabricated version number matters mechanically, not just as a clue. The registry doesn't need you to want the update; it only needs to present a number higher than the one you have. 2.1.313 is higher than 2.1.312, so every auto-updating client that checked in during the window was eligible. And it's why Anthropic shipped 2.1.314 within hours: a client that got 2.1.313 would otherwise sit on it until Anthropic's next real release.

The sentence should say that plainly. Something like: "developers whose Cursor pulled the Claude Code extension during that window, which for most people means auto-update doing it in the background, not a deliberate install." And the "What to check" section should open with: if the Claude Code extension was installed in Cursor at all and the editor was open on the 29th, check the extensions folder, whether or not you remember updating anything.

The honest version of "do I have anything to worry about" is: you don't know until you look at the folder.

The loader ran when the extension loaded. No interaction with Claude Code required. Install was the attack.

Cursor puts the exposure at up to 5,000 users. It pulled the version, shut its whole marketplace down to audit other extensions and rotate its access keys, then brought it back. The attacker's server was taken offline with the hosting provider's help.

How these marketplaces work, because that's the story

An editor extension lives in a registry under a publisher's namespace. Anthropic's is anthropic. The publisher holds a credential that lets them push new versions into that namespace. Users trust the namespace: they see "Anthropic" and "Claude Code" and don't read extension.js, because nobody does.

There isn't one registry. Microsoft's Visual Studio Marketplace is the default for VS Code, but its terms limit it to Microsoft's own products. Editors built on the open-source VS Code codebase, Cursor and Windsurf among them, use Open VSX, run by the Eclipse Foundation, or run their own registry that mirrors it. Cursor runs its own.

So a trusted name on a package is only as good as every registry that holds a copy of it. The publisher's credential protects the front door. The registry's own storage and sync are a second door the publisher doesn't control. This incident came through the second one, or through a publishing account on the first one. Nobody has said which.

The version number that gives it away

Anthropic never shipped 2.1.313. On October 30, all three places the extension ships from, Open VSX, the VS Code Marketplace and npm, go straight from 2.1.312 (published October 27) to 2.1.314 (published just after midnight UTC on October 30, on all three, within an hour of each other).

That tells you two things. The malicious build wasn't a modified copy of a real release; it was a fabricated version inserted into Anthropic's namespace, which means a registry accepted a write it shouldn't have. And Anthropic cut 2.1.314 in the middle of the night specifically to jump past the bad number, so that any client still holding 2.1.313 would see an update.

Where it was served, which is contested

The researchers who found it, Phorion and OpenSourceMalware, first reported it on Open VSX, with Cursor's marketplace receiving it by mirror sync. Cursor's notice says the malicious build was only ever in Cursor's marketplace and that the official distribution was unaffected; the researchers updated their posts to match, and Open VSX shows no record of a 2.1.313 today.

"No record now" is not "never there," and no one has published an Open VSX log. One reported detail worth holding: the extension's owner on Open VSX is listed as an individual Anthropic employee, not an organization account. If that's the publishing path, this is a borrowed-credential story. If Cursor's own storage was written to, it's a registry-infrastructure story. Cursor rotating all its marketplace keys as a first move points at the second. Neither Cursor, Eclipse nor Anthropic has explained it, and Anthropic hadn't responded to press questions as of this writing.

What the payload did

Collected username, hostname, public IP, Git email, and the names of environment variables that look like they hold credentials. Names, not values. That reads as a targeting pass: find the machines worth coming back for.

Added an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys with the comment svc-telemetry, tried to enable the SSH server, and opened a reverse tunnel to 134.209.82[.]225.

Installed persistence: a LaunchAgent on macOS, a scheduled task or Startup script on Windows, retrying the tunnel about once a minute. The tunnel runs detached, so closing the editor doesn't stop it, and uninstalling the extension doesn't remove it.

Why it mostly didn't work

Phorion found two bugs. On macOS, the loader checked whether Remote Login was on with systemsetup -getremotelogin, but ran it without admin rights, so the command returned an error instead of "Off," and the branch that would have turned SSH on never fired. On Windows, it tried to install OpenSSH through PowerShell by way of /bin/sh, which doesn't exist there.

So the tunnel only gave the attacker a way in on machines where SSH was already enabled. On a developer's Mac that's not rare. The key got planted and the recon got sent regardless.

What to check

Cursor has published check and cleanup scripts for both platforms. If a machine is confirmed hit: isolate, rotate every secret it could reach, invalidate sessions, rebuild.

Where it fits

Same shape as the Polymarket/DebugBear script the day before, one layer down the stack. A trusted name, a real product, a payload prepended to it, delivered through a channel the victim had every reason to trust. The browser didn't read DebugBear's bytes; the editor didn't read Anthropic's. Both trusted the label.

It's also the second Claude Code story in 24 hours, and the two shouldn't be conflated. The Accenture story is what an agent did with authority a person handed it. This one is what got shipped wearing the agent's name. One is a borrowed-session problem; this is a borrowed-vendor problem. Different pages.

Open

Indicators

Item Value
Package anthropic.claude-code 2.1.313 (Cursor marketplace; Open VSX disputed)
Clean version 2.1.314
C2 134.209.82[.]225
SSH key comment svc-telemetry
SSH key fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ
Tunnel private key $TMPDIR/.stk_<10 hex> (macOS)
Persistence macOS LaunchAgent; Windows scheduled task / Startup script
On-disk grep extension.js containing 134.209.82.225 or svc-telemetry

Sources