Tampered Claude Code extension on Cursor's marketplace installs a hidden SSH backdoor
October 29, 2026 (October 29 to 31, 2026)
For about 11 hours on October 29 (09:27 to 20:35 UTC), a tampered build of a Claude Code extension was available on Cursor's extension marketplace. Security firm Phorion found it and lists versions 2.1.312 and 2.1.313. The injected code ran as soon as the editor loaded the extension. It added the attacker's SSH key to the user's authorized keys, tried to turn on SSH, opened a reverse SSH tunnel to the attacker's server, set up persistence that survives restarts, and sent the machine's host name, user, system, IP address, Git email and the names of credential-like environment variables. Anthropic said the incident was not a compromise of its systems or employee laptops, that it did not build or publish the tampered extension, and that its official channels are unaffected. Cursor says it removed the version immediately, shut down its marketplace as a precaution, rotated its own keys and had the attacker's server blocked. Cursor has not explained how the package reached the marketplace. One report cites up to 5,000 affected developers, but that figure comes from industry figures, not from Anthropic or Cursor.
Why it matters
Developer tools run with access to source code, SSH keys and cloud logins, and an extension marketplace is a trusted way to install them. Uninstalling the extension does not remove the backdoor it planted.
What defenders can take from it
- If you installed or updated this extension from Cursor's marketplace on October 29, treat the machine as compromised: stop any ssh or autossh processes connecting to the tunnel server and remove the planted SSH key and persistence listed in Phorion's advisory.
- Rotate credentials that the affected user account could reach, especially if SSH was enabled or an inbound login is suspected.
- Teams: pin extension versions, limit which marketplaces are allowed, and alert on changes to authorized_keys.