Trojanized Claude Code Extension in Cursor Marketplace: What Dev Teams Must Check Now

YuSMP Group Editorial Team Editorial team, YuSMP Group

The short version

What happened in Cursor's extension marketplace?

Cursor, the AI-first code editor built on VS Code, runs its own marketplace for VS Code-compatible extensions. On October 29 it disclosed that a “maliciously modified version” of the Claude Code extension, the IDE companion for Anthropic's coding agent, had been available there for most of the US working morning. The attackers did not publish a look-alike package. They shipped the build under the genuine anthropic.claude-code ID, so editors that auto-update simply pulled it in.

Cursor says it removed the version as soon as it was detected, took the marketplace down, rebuilt it, rotated its keys and worked with the hosting provider to take the attacker's server offline. It found no other compromised extensions and is contacting every user who downloaded the affected build. Anthropic did not develop the malicious version and has published a clean 2.1.314 release to Open VSX and the Visual Studio Marketplace. Neither company has yet explained how the attacker got a build into Cursor's marketplace under Anthropic's name.

What did the malicious extension do?

According to analysis by OX Security and BleepingComputer, the attackers inserted a 66-line loader in front of the legitimate extension code. When the extension loaded, it:

• collected the hostname, username, OS, Git identity and public IP address;
• appended an attacker-controlled ed25519 key labeled svc-telemetry to ~/.ssh/authorized_keys;
• installed persistence: a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, or a SysMon scheduled task with a sysmon.cmd startup fallback on Windows;
• retried a reverse SSH tunnel to 134.209.82.225 about once a minute and posted host details to a beacon endpoint on port 8099.

BleepingComputer notes that coding errors limited the damage: the malware could not switch on SSH where it was not already running, so many machines likely got persistence without working remote access. That is luck, not a control. On any developer machine with SSH enabled, the attacker would have had a shell with the same access as the engineer.

Why are IDE extensions such an attractive target?

An editor extension runs as the developer, with access to source code, .env files, cloud CLI sessions, SSH keys and package-registry tokens. Most teams let extensions update silently, and few endpoint tools treat a signed update from a known publisher as suspicious. This incident also lands in a rough month for AI developer tooling: hosted platforms such as Railway and Northflank have disclosed breaches that exposed customer secrets, and attackers are clearly hunting the credentials that AI-heavy workflows put on developer machines.

What it means for US & EU software teams

First, the IDE is part of your software supply chain. Teams that lock down npm and container images often let any extension from any marketplace auto-update on laptops that hold production credentials. Keep an allowlist of approved extensions and publishers, and for high-privilege tools such as AI coding agents consider pinning versions or delaying updates by a day or two, so that incidents like this one are caught before they reach you.

Second, keep long-lived secrets off developer machines. A backdoor on a laptop is only as valuable as what the laptop can reach. Short-lived cloud sessions through SSO, secrets pulled at runtime from a vault, and production access that requires a separate step all shrink the blast radius. This is core cloud and DevOps hygiene, and AI tooling that wants broad local access makes it more urgent, not less.

Third, watch the endpoint for persistence, not just malware signatures. New entries in authorized_keys, new launch agents and new scheduled tasks are cheap to monitor and caught this payload directly. For EU companies, a developer laptop with access to customer data turns this into a potential GDPR incident with a 72-hour notification clock, and suppliers in scope of NIS2 should log it as a supply-chain event.

What to do this week

1. Find exposed users. List everyone who ran Cursor with the Claude Code extension on October 29 and check which version they had installed.
2. Hunt for indicators. Search for the svc-telemetry key, com.apple.sysmond.plist, the SysMon task, sysmon.cmd and connections to 134.209.82.225, using the IOC lists from Cursor and OX Security.
3. Isolate and clean. Isolate affected hosts, remove the key and persistence, stop tunnel processes, or rebuild from a known-good image.
4. Rotate credentials. Rotate SSH keys, cloud sessions, Git and registry tokens and AI API keys reachable from affected machines, and invalidate active sessions.
5. Update cleanly. Move to Claude Code extension 2.1.314 or later.
6. Set an extension policy. Approve publishers, control auto-updates for high-privilege tools and alert on new SSH keys and launch items.

Frequently asked questions

Sources

Cursor — Security notice: malicious version of Anthropic.claude-code identified in the Cursor VS Code Extension Marketplace (October 29, 2026, updated October 30)
BleepingComputer — Malicious Claude Code extension on Cursor planted SSH backdoors (October 30, 2026)
OX Security — Compromised Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistence (October 30, 2026)
Sophos — Malicious Claude Code extension distributed through Cursor marketplace