Technology and Scienceupdated 1h ago2 min read
Cursor Marketplace Trojanized Anthropic Claude Code Extension 2.1.313 With Persistent SSH Backdoor
5outlets comparedWhere the coverage agrees
3 Other2 Western MainstreamThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Trojanized Claude Code 2.1.313 distributed via Cursor and Open-VSX on Oct 29, 2026. It planted a persistent SSH backdoor on developer machines; at most 5,000 users affected.
Save coverage image
Backdoored extension window
Cursor distributed a trojanized Anthropic Claude Code VS Code extension through its marketplace, and the malicious build was version 2.1.313. Cursor said the incident affected at most 5,000 users and that the malicious version “was not developed by Anthropic,” while the company also said it plans to contact impacted users directly. The compromised package was a VS Code extension available in the marketplace of Cursor, and the malicious version 2.1.313 subsequently affected “at most 5,000 users,” presumably when systems downloaded or auto-fetched and installed it.
Anthropic pushed version 2.1.314 several hours after version 2.1.313 became available on Cursor, and the attackers gained control of the official distribution channel. Phorion CTO and co-founder Luke Roberts told Ars, “It was a supply-chain compromise where the attacker gained access to the official distribution channel.”
Persistent SSH backdoor
Phorion CEO Calum Hall explained that the compromised extension.js file included an injected immediately invoked function expression, and he said the payload executed as soon as Node loaded the file. Hall said, “The user doesn’t need to interact with the extension for the payload to fire,” and he described how the code added an attacker-controlled SSH key to the user’s authorized keys file. Cursor said the malicious extension attempts to install a persistent SSH backdoor by enabling the local SSH service and opening a reverse SSH tunnel, and it said the code was written to work on Windows, macOS, and Linux.
The extension established a reverse tunnel to “134.209.82[.]225,” installed platform-specific persistence, and transmitted host reconnaissance data to “134.209.82[.]225:8099/beacon” over an unencrypted HTTP request. Cursor’s analysis said, “Turning on the local SSH service requires admin rights,” and it said the step fails on most macOS and Windows hosts even though the extension still adds the SSH key, installs persistence, and sends host details.
Cleanup, scope, and next steps
Cursor said it worked with the cloud provider hosting the attacker’s server to take it offline, and it reported that this stopped both the tunnel and the data reports from working. Cursor also said it removed the malicious version, shut down its VS Code marketplace as a precaution, audited access and found no other tampered extensions, and it rotated its keys and rebuilt the marketplace. The malicious version was removed and Anthropic published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace, while it said users who installed Claude Code through those marketplaces are not known to be affected.
Step Security said its Dev Machine Guard flags anthropic.claude-code version 2.1.313 as malicious on developer machines, and it described identification as version-level intelligence that treats 2.1.312 and 2.1.314 as clean. Cursor told The Hacker News, “This malicious version of the extension was not developed by Anthropic,” and the same account said it does not impact other extensions downloaded from the cursor[.]com/marketplace, Grok Bot, Grok, or its other SpaceXSI product.