Two malicious packages were available for about 11 hours and may have reached up to 5,000 users. Researchers warn that removing the extension may not clear backdoors or attacker-controlled SSH keys.
Cursor has warned that malicious versions of Anthropic’s Claude Code extension were briefly available in its Visual Studio Code marketplace and may have exposed up to 5,000 users. In a security notice, the company said the tampered packages were published on 29 October 2026 and remained live for roughly 11 hours, during which developers could have downloaded software that attempted to install a persistent backdoor on their machines.
According to Cursor, the affected packages were labelled Anthropic.claude-code versions 2.1.312 and 2.1.313. The company said there is no evidence that Anthropic created the malicious software or that other versions of Claude Code were compromised. Microsoft Security Research and independent analysts at Phorion described the code as a loader that tried to give an attacker remote access, collect host information and maintain persistence across reboots.
The technical goal was to establish an SSH-based foothold. Research shared by Microsoft, Phorion and other security firms indicates that the extension attempted to insert an attacker-controlled SSH key into authorised keys, open a reverse connection to an external server and set up persistence mechanisms suited to Windows, macOS and Linux. Those included a Windows scheduled task, a macOS LaunchAgent and a Linux cron entry, with the malware programmed to keep retrying its connection at regular intervals.
Researchers also found that the code enumerated details such as operating system, username, Git e-mail address and public IP address, while checking for the presence of environment-variable names commonly associated with passwords, API tokens and cloud credentials. The malware did not appear to send the secret values themselves in its initial reporting, but the reconnaissance could still help an attacker identify valuable developer machines. Several flaws, including missing privileges and a faulty macOS permissions check, appear to have limited how often the most intrusive functions succeeded, yet security firms have warned that systems with SSH already enabled may still be exposed.
Cursor said it removed the packages, temporarily took its marketplace offline, audited access controls, replaced security keys and rebuilt the service before restoring it. The company also worked with the attacker’s hosting provider to shut down the infrastructure used in the campaign. Even so, security researchers have stressed that uninstalling the extension alone may not be enough, because persistence artefacts and SSH keys may remain on affected systems and should be checked separately.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
