Eleven Hours of a Trojanized Extension: Cursor's Marketplace Served a Claude Code Build With an SSH Backdoor
For nearly twelve hours, the Claude Code extension you could install from Cursor's marketplace carried an SSH key that didn't belong to Anthropic. Uninstalling the extension doesn't remove that key from your machine.
What Happened, With Times
On October 29, 2026, between 2:27 am and 1:35 pm Pacific, Cursor's extension marketplace served a modified build of anthropic.claude-code. The window comes from Cursor's own security notice and matches Ars Technica's summary: almost twelve hours with a backdoored build available to install. On October 30, Cursor pulled the builds, shipped a fixed release and put a number on the blast radius, and Microsoft Security published its own code analysis.
2:27 am to 1:35 pm Pacific: Almost Twelve Hours of Exposure
The duration is the uncomfortable part. This wasn't a package that sat online for a few minutes. For half a day it was the version the marketplace handed to anyone installing or updating the extension inside that window.
Builds 2.1.312 and 2.1.313, for macOS ARM and Windows x64
Cursor's notice names version 2.1.313 with darwin-arm64 and win32-x64 builds. Cryptopolitan also mentions 2.1.312. Ars Technica reports the malicious code was written to run on Windows, macOS and Linux, even though the marketplace published only those two builds.
Read also
Up to 5,000 Users Exposed, per Cursor
Exposed is not the same as infected. The 5,000 accounts are the ceiling of users who could have downloaded the build, not the number of machines where the tunnel actually came up. Cursor recommends applying the remediation even if the tunnel never completed.
How the Package Got In: What Hasn't Been Explained
Cursor told OpenSourceMalware the extension had "experienced some form of compromise". How the modified build reached the marketplace has not been publicly explained. There is also no statement from Anthropic in the available coverage: what exists comes from Cursor and Microsoft.
What the Malicious Code Did
The payload wasn't a quiet token grab. It was persistent remote access, built in four steps that run in order.
A 66-Line Loader Prepended to extension.js
Analyses from OpenSourceMalware and CybersecurityNews describe a block of roughly 66 lines inserted at the top of extension.js. It sits before the legitimate initialization, so it runs first: when the editor starts and again when the extension's webview opens.
A Key Named svc-telemetry in ~/.ssh/authorized_keys
The code appends an attacker-controlled public key to the end of ~/.ssh/authorized_keys, labeled svc-telemetry so it looks like a telemetry component of the editor itself. With that key in the file, the SSH server accepts the connection without a password and without anything looking out of place in the list.
Reverse Tunnel to 134.209.82[.]225 and a POST With Host Details
Next it tries to turn on the local SSH service and opens a reverse tunnel to port 22 on 134.209.82[.]225 as the tunnel user, pointing back at the machine's own port 22. It also sends host details over HTTP to port 8099 on the same IP and probes 127.0.0.1:8099. A reverse tunnel connects outward from your machine: you don't need to open a port on the router, which is exactly what keeps it invisible on a home or office network.
Persistence: Reconnecting Every 60 Seconds, Host Checks Off
The tunnel disables server identity verification and retries every minute. That combination is what makes it persistent: if the process dies, it comes back; if the remote server changes its key, it doesn't complain.
The macOS Detail That May Have Limited the Damage
A Phorion analysis summarized by explainx points to a flaw in the macOS variant that may have reduced the real-world damage on those machines. That is a third-party observation, not official confirmation, so treat it as a lead rather than a proven fact.
Why This Matters Beyond the Incident
The specific case is handled with hygiene and credential rotation. What doesn't get fixed as easily is why it worked.
The Marketplace Is the New npm: One Click, Full Trust in the Package Identity
Installing an extension means running third-party code with your permissions, inside the editor that has your project, your keys and your terminal open. An editor marketplace does what npm did: it resolves the package name, checks that the account exists and hands it over. It's the same trust model that already cost us in Plugin4Shell, where the problem wasn't a plugin's code but who approved it.
A Publisher Name Is Not a Vendor Signature
The package was called anthropic.claude-code and sat under Anthropic's account. That is not a cryptographic vendor signature and not a content review: it's an account identifier in a registry. When that account or the publishing channel is compromised, the name stays intact while the contents no longer do.
2026 Already Had Precedents: GlassWorm, Nx Console and the GitHub Case
GlassWorm in October, with fake VS Code themes on the Visual Studio Marketplace and Open VSX; Nx Console compromised in May with 2.2 million installs; and a GitHub breach through a poisoned extension that reached about 3,800 internal repositories. Three vectors, one pattern: the distribution channel for development tools is part of the attack surface.
How to Tell If You Were Affected
Check the Installed Version and When It Last Updated
In Cursor, the extensions view shows the installed version. From the editor's terminal, code --list-extensions --show-versions returns name and number. If you see 2.1.313 or 2.1.312 dated October 29, run the full remediation even if nothing else turns up.
Look for the Key and for Tunnel Processes on the Machine
Read the tail of ~/.ssh/authorized_keys looking for an entry commented svc-telemetry. Then check running processes for ssh -R, which is what a reverse tunnel looks like. On Windows the file lives at %USERPROFILE%\.ssh\authorized_keys.
Check Outbound Connections to 134.209.82[.]225 and the SSH Log
Any outbound connection to port 22 or 8099 on that IP from a development machine is a signal. The SSH service log shows attempts to enable it if the system didn't have it running before.
What to Do, in Order
1. Collect Evidence Before Deleting Anything
Copy authorized_keys, the process list and the SSH logs to another medium before touching the machine. Delete first and you lose any chance of knowing what came in and what left.
2. Remove the Key From authorized_keys and Kill the Tunnel
Drop the svc-telemetry line, kill the tunnel processes and confirm they don't come back. Check startup entries too: Microsoft warned that removing the build from the marketplace does not erase artifacts already present on the machine.
3. Rotate Everything That Lived on That Machine
SSH keys, Git tokens, cloud credentials, API keys in environment variables and browser sessions with access to dashboards. If that machine could reach production, the rotation scope is everything that access allowed.
4. Reinstall From the Official Source and Pin the Version
Install from the official channel and pin the version, the way you pin a project's dependencies. The contrast with PHP2Shell is useful here: in that case the vendor shipped a patch and updating solved it. Here, updating cleans up nothing that was already installed.
What to Change in How You Work
Pin Extension Versions and Read What an Update Changes
Extensions update themselves and almost nobody reads the changelog. Pinning the version and reviewing before you bump turns a silent update into your decision.
Fewer Production Credentials on a Developer Laptop
The development machine is the one holding everyone's keys. Keeping less there, or moving it to a secrets manager with expiry, limits the damage of any future incident without depending on detecting this one.
Your Dev Machine Is Attack Surface Too
The supply chain for coding tools stopped being an infrastructure topic. Agents and editors with access to the project are part of the perimeter and deserve the same review as an exposed server.
Conclusion
The lesson isn't to distrust Claude Code or to stop using agents. It's that installing an extension means running third-party code with your permissions, and that decision deserves the same scrutiny as an npm install in someone else's project. If you installed the extension from that channel on October 29, check first and rotate after; the rest of the technology news thread is on the blog.
