Malicious Claude Code VS Code Extension Distributed via Cursor Marketplace Installs Persistent SSH Backdoors
What Happened — On October 29, 2026 a tampered version of Anthropic’s Claude Code extension (version 2.1.313) was published in Cursor’s VS Code‑compatible marketplace for roughly 11 hours. The malicious package injected a JavaScript loader that runs automatically when the extension loads, attempting to add an attacker‑controlled SSH key, enable remote login, and create a reverse tunnel on the developer’s machine. Up to 5,000 developers who installed the extension were exposed to this behavior. Coding errors in the backdoor’s setup routine prevented successful remote access on many Windows and macOS hosts, but the threat remained active while the extension was available. Cursor confirmed the incident and is investigating how the compromised package was signed under Anthropic’s name. Source: BleepingComputer
Why It Matters for Trust & Control Assurance — The episode highlights the need for rigorous third‑party software‑supply‑chain controls and continuous monitoring of extension provenance.
Who Is Affected — Technology/SaaS developers, software vendors that rely on VS Code extensions, and any organization that permits developers to install third‑party IDE add‑ons.
Recommended Actions
- Inventory all installed VS Code extensions and remove any that are not explicitly approved.
- Enforce signed‑extension policies and validate publisher certificates before installation.
- Deploy endpoint detection that watches for unauthorized SSH key additions or scheduled‑task creation.
- Incorporate extension‑supply‑chain checks into your vendor‑risk program and retain evidence for audit readiness.
Technical Notes
- Attack vector: malicious third‑party VS Code extension (supply‑chain compromise).
- Payload: JavaScript loader that writes an attacker‑controlled SSH public key, attempts to enable SSH service, and creates a reverse tunnel via macOS LaunchAgent or Windows scheduled task.
- No CVE; the vulnerability resides in the marketplace’s lack of extension verification. Source: BleepingComputer