Trojanized Claude Code Extension Hit Cursor Marketplace in 11-Hour Supply-Chain Attack

On October 29, 2026, attackers pushed a trojanized build of the Anthropic Claude Code VS Code extension through Cursor's third-party marketplace, where it silently planted an SSH backdoor on every developer machine that loaded the editor during an 11-hour window. Two versions — 2.1.312 and 2.1.313 — carried the payload. Cursor's security team removed the affected versions, took the attacker's command-and-control server offline, and locked down its marketplace; Anthropic published a clean 2.1.314. What neither company has explained is how a malicious build was pushed through Anthropic's own verified publisher account on Cursor's platform without an apparent breach of Anthropic's internal systems.

What the 66-Line JavaScript Payload Actually Did

The payload was a 66-line IIFE — an immediately-invoked function expression — prepended to the extension's main JavaScript bundle, extension.js, producing a SHA-256 fingerprint of ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, according to a technical analysis by StepSecurity. When VS Code or Cursor loaded the extension, the injected code executed automatically, before the legitimate Claude Code functionality ran, and without any additional user action.

The first action taken by the malicious loader was to append a new Ed25519 public key to the system's SSH authorized_keys file. The key was tagged with the comment svc-telemetry to disguise itself as a routine monitoring service credential, per analysis of the payload. Possession of the matching private key gave the attacker passwordless, persistent SSH access to any machine where the step completed successfully.

The code then opened a reverse SSH tunnel to a command-and-control server at 134.209.82.225 on TCP port 22, while simultaneously sending an HTTP beacon to port 8099 on the same address to register the newly reached machine. Reverse tunnels matter here: they allow an attacker to reach machines sitting behind NAT or corporate firewalls without requiring an open inbound port on the victim side, effectively bypassing a common network-perimeter control.

Three-Platform Persistence Masqueraded as System Infrastructure

Platform-specific persistence ensured the tunnel would survive reboots. On macOS, the malware wrote a LaunchAgent plist using the identifier com.apple.sysmond, a string chosen to blend with Apple's legitimate system monitoring daemon. On Linux, it injected an @reboot cron entry into the current user's crontab. On Windows, it registered a scheduled task under the SysMon name. Each approach is low-noise precisely because it mimics legitimate system infrastructure rather than introducing obvious new processes.

Why Most macOS and Windows Machines Escaped Full Compromise

One structural factor reduced actual compromise rates across the developer population: enabling SSH service access or appending to an already-running service's authorized_keys file requires administrator rights on modern macOS and Windows systems in many configurations. The Claude Code extension runs in user context without elevation, meaning the SSH-enablement step failed silently on many machines. Linux developer systems present a higher-risk profile here because SSH daemons run by default under most distributions, making the key-planting step more likely to reach a running service.

Malicious Build Shipped Through Anthropic's Own Publisher Account

Security firm Phorion and independent researcher Kevin Beaumont both confirmed that the malicious build was distributed through Anthropic's own verified publisher account on Cursor's marketplace — not a namespace collision or a spoofed account with a similar name, according to BleepingComputer's reporting. Anthropic has publicly stated that its internal systems were not breached. Cursor has not published an explanation of how the publisher account was accessed or why the malicious push was not detected at the platform level before distribution.

The access vector matters beyond this specific incident. Cursor's marketplace is a distinct platform from Microsoft's VS Code Marketplace and the Eclipse Foundation's Open-VSX registry. Both of those platforms were unaffected, as Anthropic security staff confirmed. The attack surface was specifically within Cursor's publisher account management infrastructure. Without an account of how that account was accessed, developers cannot assess whether the compromise was an isolated credential theft or reflects a structural weakness in how Cursor authenticates extension publishers.

Scope, Affected Versions, and a Remediation Gap That Persists After Uninstall

Cursor estimated exposure at approximately 5,000 developers during the window between the first malicious push at roughly 02:27 PT on October 29 and the marketplace takedown at approximately 13:35 PT — a span of just over 11 hours, per Cursor's official security notice. The affected version numbers were 2.1.312 and 2.1.313, covering both Windows and macOS builds. Anthropic published 2.1.314 as the clean replacement, deliberately skipping the 2.1.313 version number to prevent any cached or mirrored distribution of the compromised release from being treated as the latest build.

Developers who ran either affected version must check for persistence even after uninstalling the extension. Uninstallation removes the extension code but leaves the injected SSH authorized_keys entry intact, as well as the LaunchAgent, cron entry, or scheduled task depending on the operating system. Cursor published platform-specific remediation scripts. Any machine that loaded the malicious code should be treated as having registered with the now-offline C2 server; credentials accessible from development environments on those machines — tokens, API keys, repository access — should be rotated.

AI Coding Extensions Are the New Priority Supply-Chain Target

This is the latest in an accelerating series of supply-chain attacks against VS Code-adjacent marketplaces and AI coding toolchains. In May 2026, a chained supply-chain compromise enabled attackers to push a malicious Nx Console extension build to VS Code marketplaces during an 18-minute window; credentials stolen from a GitHub employee's machine subsequently gave access to approximately 3,800 GitHub internal repositories, an incident documented in Nx's postmortem. AI coding tools are an attractive target class because they receive broad filesystem access, terminal execution rights, and environment-variable visibility by design — an extension in that context carries a substantially larger post-compromise surface than a typical language-server plugin.

Publisher Account Credentials Remain the Ecosystem's Missing Trust Layer

The structural risk visible in this incident is the absence of mandatory cryptographic artifact signing for extension marketplaces. Publisher credentials — a password, a token, or an OAuth session — are a single control point: if an attacker obtains them, everything published under that identity becomes suspect until revoked. Signing each artifact against a developer-held private key, with the corresponding public key pinned independently of account credentials, would convert a publisher-account compromise into a detectable forgery. Neither Cursor, Microsoft's VS Code Marketplace, nor Open-VSX currently mandates this.

The Cursor incident is contained in the sense that the C2 server is offline and the affected versions are withdrawn. It is not contained in the sense that its enabling condition — publisher accounts as the sole trust anchor for extension distribution — remains unchanged across the ecosystem. Until the access vector is disclosed and publisher-authentication requirements are hardened, the same attack structure is available to any actor who can reach the right account.