Trojanized Anthropic Claude Code Extension v2.1.313 Delivers SSH Backdoor via Cursor Marketplace

On October 29, 2026, a trojanized Anthropic Claude Code extension (ID: anthropic.claude-code), versions 2.1.312 and 2.1.313, was distributed via the Cursor Marketplace and Open VSX under a compromised legitimate publisher identity. The malicious VSIX inserted an attacker-controlled SSH key, established uninstallation-resistant persistence through startup scripts, enumerated host information, and opened a reverse SSH tunnel targeting macOS Apple Silicon and Linux. Anthropic disavowed the build; no CVE was assigned, evading CVE-driven scanners. Up to 5,000 developers face persistent remote access and lateral movement risk.

• Supply Chain Compromise: Extension Distribution

  • Trojanized anthropic.claude-code v2.1.312 and v2.1.313 distributed via Cursor Marketplace and Open VSX under legitimate publisher identity.
  • Malicious build remained available for approximately 11 hours on October 29, 2026.
  • Microsoft Visual Studio Marketplace was unaffected; Cursor temporarily shut down the marketplace.
  • Anthropic confirmed it did not develop the malicious build and disavowed the package.

• Attack Mechanics: SSH Backdoor & Persistence

  • Payload inserts an attacker-controlled SSH key into the developer host and collects host information.
  • Persistence via startup scripts survives extension uninstallation; reverse SSH tunnel enables remote access.
  • Targets macOS on Apple Silicon with additional Linux code paths.
  • No CVE assigned; signature-based and CVE-driven scanners will not flag versions 2.1.312 or 2.1.313.

• Impact & Exposure

  • Up to 5,000 developers using Cursor or VS Code-compatible editors potentially affected.
  • Primary risks include persistent remote access, credential theft, lateral movement, and environment compromise.
  • Detection gap requires behavioral monitoring and package provenance verification.

• Detection & Remediation

  • Verify extension provenance and publisher identity before installation.
  • Audit authorized SSH keys and startup scripts on affected hosts.
  • Remove malicious versions 2.1.312 and 2.1.313; inspect for persistence artifacts post-uninstall.
  • Monitor for outbound reverse SSH connections and unauthorized host enumeration.

• Strategic Implication

  • Incident demonstrates trust abstraction risk in third-party extension marketplaces.
  • Absence of CVE undermines traditional vulnerability scanning for supply chain trojans.
  • Developer environments remain high-value targets for persistent access and lateral movement.