Trojanized Claude Code Extension in the Cursor Marketplace Planted a Persistent SSH Backdoor

On October 29, 2026, Cursor's extension marketplace served tampered builds of the Claude Code extension, anthropic.claude-code versions 2.1.312 and 2.1.313 for macOS and Windows. The listings used Anthropic's identifier and publisher, but a 66-line loader prepended to extension.js installs a persistent SSH backdoor. The loader contains Linux code paths, but Cursor only served tampered builds for macOS and Windows. Its published hashes cover only darwin-arm64 on macOS, and neither Cursor nor OpenSourceMalware says whether darwin-x64 builds for Intel Macs were affected. Anthropic's own extension release on the Visual Studio Marketplace was not affected, nor was the Claude Code CLI on npm (@anthropic-ai/claude-code) or Open VSX.

Uninstalling or updating the extension does not remove the backdoor. Treat any machine that loaded either version from Cursor's marketplace as compromised until you have proven otherwise.

TL;DR

• What happened: Cursor's marketplace served trojanized 2.1.312 and 2.1.313 builds for about 11 hours on October 29, reaching at most 5,000 users. Version 2.1.314 is clean, and so is the official 2.1.312 from the Visual Studio Marketplace.
• What it does: adds an attacker SSH key (svc-telemetry) to ~/.ssh/authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, installs persistence, and sends host details plus the names of secret-looking environment variables to the attacker.
• What to do: find every Cursor install of either version, isolate those machines, remove persistence and the SSH key, block the C2 address, and rotate every credential the user could reach.
• Detection: Mondoo inventories the VS Code extensions on every workstation, across VS Code, Cursor, Windsurf and other forks, and flags affected installs through advisory MONDOO-ADV-2026-hkmio.

What Cursor has confirmed

According to Cursor's security notice, the malicious versions were available between about 2:27am and 1:35pm PT on October 29, "at most 5,000 users were affected," and the versions were "not developed by Anthropic." Cursor will contact affected users directly. It first named only 2.1.313 and added 2.1.312 on October 30. Cursor removed both versions, shut down and rebuilt its marketplace, audited access, found no other tampered extensions, rotated its keys, and had the attacker server taken offline.

The two versions differ in one way that matters for detection. Anthropic never published a 2.1.313 of the extension on the Visual Studio Marketplace, and there is no 2.1.313 of the Claude Code CLI on npm either; both go from 2.1.312 straight to 2.1.314. Version 2.1.312 does exist on both, and that official release is clean; only the copy Cursor served was modified.

How did a malicious build carry the official name?

Cursor has not said. Its notice does not explain how a build Anthropic did not develop was published under the anthropic.claude-code identifier, and no root cause analysis has been published. Cursor runs its own marketplace instead of installing from Microsoft's, and its response (shutting the marketplace down, auditing access, rotating keys and rebuilding it) is what you do when the distribution system itself may have been tampered with.

Mondoo Research recommends avoiding the Cursor marketplace until Cursor publishes a full root cause analysis. Cursor has reinstated the marketplace, but without knowing how the build got in, nobody outside Cursor can judge whether the gap is closed. Until then:

• Turn off automatic extension updates in Cursor (extensions.autoUpdate) and pause new installs.
• Pin the extensions you already have to versions you have verified, and check them against the indicators below.
• If a developer needs an extension now, install it from a source you can verify, such as the publisher's own release, and review it before rollout.
• Lift the restriction once Cursor's root cause and fix are public.

How the loader works

The step-by-step behavior below comes from the OpenSourceMalware analysis of the tampered package. Cursor's notice confirms the outcome: the collected host data, the added SSH key, the reverse tunnel, the persistence and the beacon.

The extension declares no install or lifecycle scripts. The loader sits at the top of the bundled extension.js, ahead of the legitimate code, and runs when a VS Code based editor loads the extension, at startup or when its webview opens. The user never has to start a Claude conversation. The loader swallows its own errors, so the real extension keeps working.

1. Reconnaissance. It collects the hostname, user name, OS and CPU architecture, home and working directory, global Git email, and public IP address (from ifconfig.me or api.ipify.org), plus the names, not the values, of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.
2. SSH access. It creates ~/.ssh if needed, appends an attacker Ed25519 public key with the comment svc-telemetry to authorized_keys, and tries to enable the SSH server: systemsetup -setremotelogin on on macOS, systemctl on Linux, OpenSSH Server through PowerShell on Windows. Cursor says errors in the malicious code make this step fail unless Cursor was started with administrator privileges. Persistence and the beacon run either way.
3. Reverse tunnel. It decodes an embedded private key (comment svc-telemetry-tun) to a temporary .stk_<id> file and connects as user tunnel to 134.209.82.225 with -R *:0:localhost:22. That exposes the victim's SSH server to the attacker through any firewall that allows outbound SSH. It retries about every 60 seconds, and Cursor says the dropped scripts keep running after the extension is uninstalled.
4. Persistence. A user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS (not an Apple component, despite the name), an @reboot crontab entry on Linux, and a SysMon scheduled task or Startup folder script on Windows.
5. Beacon. A plain HTTP POST of the collected data to http://134.209.82.225:8099/beacon.

Nothing else is downloaded. The scripts and keys are generated or decoded from content inside the extension.

Why this matters for developer workstations

This incident combines three risks we have covered before: Glassworm spreading through editor extensions, the LiteLLM compromise turning a trusted AI developer tool's release channel into a malware channel, and shadow AI on developer machines.

• Publisher checks would not have caught it. The listing carried the official identifier, so typosquat and unknown publisher checks pass.
• Editor extensions run with the user's privileges and no sandbox. They can read SSH keys, cloud credentials and source code, and start processes that outlive the editor.
• Each VS Code fork is its own supply chain. Cursor, Windsurf, VSCodium and other forks install from their own marketplaces or from Open VSX, so a clean listing in one registry says nothing about the same identifier in another.
• AI coding extensions are installed quickly, often without review, and are expected to touch code, terminals and credentials. That makes them an effective disguise.

Find affected machines with Mondoo

Most endpoint software inventories do not list editor extensions. They live in each user's home directory, and every VS Code fork keeps its own extensions folder.

Mondoo inventories them automatically on every workstation it scans. It records the identifier, version, publisher, editor and install path for every user profile and every major VS Code based editor: Visual Studio Code and Insiders, Cursor, Windsurf, VSCodium, Kiro, Positron and Antigravity. Mondoo matches that inventory against MONDOO-ADV-2026-hkmio, so affected workstations show up as findings without anyone writing a query. Because the official 2.1.312 shares its version number with Cursor's tampered copy, a clean Visual Studio Code install of 2.1.312 is flagged too; the editor field tells the two apart.

To query the inventory yourself, install cnspec on a workstation and open a shell (see querying with cnspec):

BashCopy
cnspec shell local

List every Claude Code install of an affected version and the editor it belongs to:

MQLCopy
vscode.extensions.where(
  identifier == /anthropic\.claude-code/i && semver(version).inRange("2.1.312", "2.1.313")
) { editor identifier version path }

Or run a check that fails on any machine with an affected Cursor install:

MQLCopy
vscode.extensions.none(
  identifier == /anthropic\.claude-code/i && semver(version).inRange("2.1.312", "2.1.313") && editor == "Cursor"
)

The same inventory shows which editors, extensions and AI coding agents run on each machine, and which machines run outdated versions.

What to do now

Start by checking for the attacker key. Cursor's notice gives this check for macOS (on Windows, search %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys the same way):

BashCopy
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key FOUND" || echo "not found"

Cursor also publishes remediation scripts for macOS (run as the affected user, not as root) and Windows (run from an elevated PowerShell) in its security notice. There is no official script for Linux, so follow the manual steps below.

If 2.1.312 or 2.1.313 from Cursor's marketplace was installed on a machine, do these steps in order:

1. Isolate the machine from the network, and preserve evidence before you remove anything. Cut network access, then run the cleanup below and Cursor's scripts locally or through your EDR.
2. Block 134.209.82.225 on TCP 22 and 8099 at your egress points.
3. Stop the tunnel. Kill any ssh or autossh process connecting to 134.209.82.225 and the /bin/sh loop that restarts it.
4. Remove persistence.
   • macOS: unload and delete ~/Library/LaunchAgents/com.apple.sysmond.plist, then delete ~/.config/.smt, ~/.config/.smtk and any .stk_* file in $TMPDIR.
   • Linux: remove the @reboot crontab entry that runs ~/.config/.smt and confirm your other cron jobs are intact, then delete ~/.config/.smt, ~/.config/.smtk and any /tmp/.stk_* file.
   • Windows: delete the SysMon scheduled task and sysmon.cmd from the Startup folder, then delete %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk and any .stk_* file in %TEMP%.
5. Clean SSH access. Remove the svc-telemetry key from authorized_keys, and turn off Remote Login or the SSH server if nobody enabled it on purpose.
6. Update the extension to 2.1.314 or later.
7. Assume compromise if the tunnel ran. Review SSH logs for logins from 127.0.0.1 or ::1 with the svc-telemetry key, rotate every credential the user could reach from a known clean machine, and consider rebuilding the host. Removing the known artifacts does not prove the attacker did not use the interactive access to leave something else behind.

Indicators of compromise

These are the indicators Cursor published. Everything except the VSIX hashes applies to both 2.1.312 and 2.1.313. Cursor served tampered builds only for macOS and Windows, but it also lists Linux indicators because the loader contains Linux code paths.

Modified VSIX packages

Shared across both versions

References

• Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) (Cursor, with remediation scripts and indicators)
• MONDOO-ADV-2026-hkmio (Mondoo advisory)
• Trojanized Claude Code extension plants persistent SSH backdoor (OpenSourceMalware analysis)
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor (The Hacker News)
• Claude Code extension poisoned with persistent SSH backdoor (Help Net Security, including Cursor's statement)

How Mondoo helps

Mondoo's AI security and shadow AI coverage starts with an inventory of what runs on developer workstations, including the editor extensions, AI coding tools and agent configurations that endpoint inventories miss. Mondoo Research publishes advisories like MONDOO-ADV-2026-hkmio as incidents break, and Mondoo flags affected workstations as soon as an advisory is published.

Ready to see Mondoo in action? Schedule a demo today.