A Trojanized Claude Code Extension Tried to Plant an SSH Backdoor
Cursor distributed two malicious Claude Code-branded extension versions for roughly 11 hours. The injected code attempted to install an SSH key, reverse tunnel and persistence. Microsoft confirms the attack chain, but Anthropic and Microsoft’s official distribution channels were not compromised.
A tampered copy of Anthropic’s Claude Code extension was distributed through Cursor’s extension marketplace for about 11 hours on October 29. The injected code attempted to plant an SSH key, create a reverse tunnel and install persistence. Microsoft’s independent analysis confirms the attack chain, while both companies say Anthropic’s systems and the official Visual Studio Marketplace package were not compromised.
The 30-second summary
- What happened? Cursor served malicious versions 2.1.312 and 2.1.313 of a Claude Code-branded extension.
- Why does it matter? Code-editor extensions execute with developer permissions and can reach source code, credentials and local tools.
- What is the catch? Programming errors and missing administrator rights blocked full SSH access on most systems, but installed keys and persistence files may remain.
Key Number: The malicious package was available from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29.
The package tried to create persistent access
Microsoft found injected JavaScript that ran before the expected extension code. It collected host details, appended an attacker-controlled key to SSH authorization files, attempted to enable the local SSH service and opened an outbound reverse tunnel. Platform-specific scripts then tried to restart that connection after login or reboot.
The malware used names resembling system monitoring tools and continued running the legitimate extension, reducing the chance that a developer would notice immediately. Cursor says the attacker’s server has been taken offline and the marketplace was rebuilt after an audit and key rotation.
This was not an Anthropic breach
The affected packages came from Cursor’s marketplace. Microsoft says they never appeared in its Visual Studio Marketplace or the official npm distribution, and Anthropic told Microsoft that its systems were not compromised. The distinction matters because a familiar brand name can make a marketplace package appear trustworthy even when its distribution channel has been altered.
The incident adds a concrete software-supply-chain dimension to recent concerns about AI development-environment containment. The immediate risk here did not come from a model deciding to escape; it came from malicious code shipped inside a tool developers installed.
Before we overstate the result
The loader attempted a capable backdoor, but an attempted chain is not proof that every affected machine was remotely controlled. Cursor says errors and administrator-permission requirements prevented the SSH service from working on most macOS and Windows systems. Users should still investigate because the extension could write keys and persistence artifacts outside its own installation directory.
What affected users need to do
Cursor and Microsoft recommend identifying devices that installed the two versions, preserving evidence, isolating systems with suspicious artifacts and removing the unauthorized key and startup mechanisms. Simply uninstalling or updating the extension may not remove files written elsewhere. Organizations should rotate credentials or sessions from a clean device when investigation shows exposure and restrict extensions to approved publishers where possible.
Verified topics and entities
Sources and citations3 sources
External references used to support the reporting in this article.
Published by
NewTqnia Artificial Intelligence Desk
An institutional editorial team within NewTqnia
