Tampered Claude Code extension on Cursor planted SSH backdoor
The loader wrote SSH keys and persistence hooks whether or not its reverse tunnel connected, so a failed tunnel isn't proof of a clean host.
TL;DR
On Oct 29, 2026, Cursor's marketplace served tampered Claude Code versions 2.1.312 and 2.1.313 for roughly 11 hours, from about 2:27 AM to 1:35 PM PDT. Microsoft's analysis of the injected JavaScript found a loader that adds an attacker-controlled SSH key, enables local SSH, sets up reverse forwarding and persistence, and reports host details. The packages never touched Visual Studio Marketplace or npm, and Anthropic confirmed its own systems weren't compromised. The loader can write persistence artifacts even when the tunnel fails, so Cursor users shouldn't treat a failed connection as a clean signal.
Cursor's extension marketplace served a tampered copy of Anthropic's Claude Code extension for roughly 11 hours on Oct 29, 2026, from about 2:27 AM to 1:35 PM PDT. Versions 2.1.312 and 2.1.313 carried an injected JavaScript loader that ran before normal extension initialization. Once loaded, it attempted to append an attacker-controlled SSH key, enable the local SSH service, establish reverse SSH forwarding, set platform-specific persistence, and report host details.
One thing is already unambiguous. The malicious packages lived only on Cursor's marketplace. Microsoft confirmed they weren't published to Visual Studio Marketplace or the npm registry, and Anthropic told Microsoft its own systems weren't compromised and it didn't build the package Cursor served. The compromise sits at the marketplace layer, not in the upstream project.
Defenders should resist one shortcut. Successful remote access depends on host privileges, SSH configuration, and the attacker's server. A reverse tunnel that fails to connect doesn't mean the loader ran clean; Microsoft notes it may still write SSH keys and persistence artifacts even when tunnel access fails. Start by identifying systems that installed or auto-updated to these versions, then preserve evidence, remove confirmed artifacts, review endpoint and network telemetry, and rotate credentials or revoke sessions where exposure is indicated.
Published ·Deep Fathom