Claude Code Extension Infected with Backdoor on Cursor Marketplace

On October 30, security company Phorion disclosed a supply chain attack targeting Cursor’s own extension market: Two versions of Anthropic’s official Claude Code extension were compromised, exposing approximately 5,000 users to risk. Related discussions quickly topped Hacker News’ hot lists, with around 908 upvotes and 533 comments by that day. The core focus was on “why the review mechanism for extensions allows legitimate publisher IDs to release malicious updates.” For many developers who use Claude Code as their daily AI programming assistant, this incident served as a wake-up call for supply chain security and provided an opportunity to re-examine the trust boundaries of their development environments. This article is based on Phorion’s report, Cursor’s security announcement, and Anthropic employees’ responses on Hacker News. Specific technical details are subject to the official final documentation.

What Happened

The malicious versions were anthropic.claude-code 2.1.312 and 2.1.313, distributed through Cursor’s own VS Code Extension Marketplace, not the official VS Code Marketplace or OpenVSX. Cursor indicated that the exposure window lasted from 02:27 to 13:35 Pacific Time on October 29, lasting approximately 11 hours, potentially affecting up to 5,000 users.

Unlike typical phishing or name-missleading attacks, this update directly used a legitimate publisher ID. Attackers obtained permission to release updates for anthropic.claude-code on Cursor Marketplace, leaving users with little reason to suspect anything during automatic updates. After Phorion published the report on October 30, Cursor quickly confirmed the incident and removed the malicious versions, effectively keeping the exposure window within half a day.

The payload executed upon loading the extension module, before the normal activate callback, without requiring user interaction. It first collected the host name, username, operating system, architecture, home directory, current working directory, global Git email, and environment variable names matching KEY, TOKEN, SECRET, PASS, AWS, GCP, etc. The collected information was sent in plaintext via HTTP to 134.209.82.225:8099/beacon. Subsequently, it appended the attacker’s Ed25519 public key to ~/.ssh/authorized_keys with the note “svc-telemetry” and attempted to enable local SSH services, then establish a reverse SSH tunnel to the same server. To remain persistent, it wrote into LaunchAgent on macOS, created scheduled tasks on Windows with startup scripts, and entered crontab on Linux, retrying the tunnel every approximately 60 seconds in the background.

Among these, enabling local SSH service requires administrator privileges; reverse shells are difficult to trigger with ordinary privileges. However, information gathering, SSH public key implantation, and persistence can be carried out with low privileges. This means that even if users use the editor with ordinary privileges, they may have already had their host information leaked and a backdoor left open. For developers using Claude Code, malicious code could complete information gathering instantly upon opening the project. Even more problematic is that VS Code extensions run in the Node.js main process environment, theoretically allowing them to call modules such as fs, child_process, and net. Once this high-privilege context is exploited by malicious code, it is almost equivalent to executing arbitrary code locally. Phorion was able to locate the beacon server because Payload used plaintext HTTP connections, exposing the attacker’s infrastructure directly. This unencrypted connection method reduced the attacker’s concealment but also allowed a large number of hosts to send information back within hours.

The official statement doesn’t match

Anthropic quickly clarified: This was not an invasion of Anthropic’s system or employee computers. Version 2.1.313 was never released through OpenVSX, VS Code Marketplace, or Anthropic’s official channels. Only the Cursor Marketplace was affected. The next version will skip 2.1.313 and directly release 2.1.314 for distinction.

Cursor also responded swiftly: It removed the malicious version, closed the entire marketplace, audited access logs, confirmed that no other extensions were tampered with, rotated keys, rebuilt the marketplace, and took the attacker’s server offline, while proactively reaching out to affected users.

But speed does not mean no responsibility. The key issue in this incident was not that Anthropic’s code was rewritten, but that the release permissions of Cursor Marketplace were breached. The attacker was able to push updates as an official publisher, indicating that there was a single-point risk in the marketplace’s access control and auditing processes. Users usually trust automatic updates from installed extensions but rarely verify signatures or sources. Even more troublesome is that uninstalling an extension does not necessarily eliminate the threat: Persistent scripts can be located outside the extension directory, and even if the extension is removed, the backdoor may continue to run.

This incident also revealed a deeper problem: The “official publisher” status in the extension market does not equate to security. Once the release endpoint is compromised, the update notifications users see are no different from normal updates. While closing the entire marketplace was a prudent move by Cursor, it also shows that it could not quickly distinguish which publishers were trustworthy and which were not. This “one-size-fits-all” approach precisely proves the weakness of the original auditing mechanism. Anthropic’s decision to skip 2.1.313 was more like a version labeling action; it did not solve the problem of third-party marketplaces being breached, but only helped users distinguish between official channel versions. Cursor never explained how the attacker obtained release permissions, which is crucial for assessing the root cause of the incident. In the context of frequent supply chain attacks, simply relying on version jumps and platform removals is no longer enough to restore user trust.

What’s being said in the comments section

Discussions on Hacker News mainly revolve around several questions.

First, whether other channels are safe. Some comments suggest that malicious versions have also appeared in OpenVSX or NPM. Anthropic staff explicitly denied this; Phorion stated that 2.1.313 on VS Code/NPM was also removed, but it may not be the same malicious package. The official stance limits the risk to Cursor Marketplace, and ordinary users should follow the official instructions.

Second, why the review mechanism failed. Highly-upvoted comments pointed out that this was not an ordinary typosquat or counterfeit package attack, but a supply chain attack using legitimate publisher IDs. When attackers can push updates to real extensions, even the most diligent users find it difficult to distinguish visually. The community generally believes that closing the entire Cursor Marketplace is a prudent move, but it also exposes the common weaknesses in third-party extension markets in terms of version control.

Third, regarding the trust boundary of automatic updates. Many netizens said that they used to allow IDE extensions to automatically update without condition because the default official publisher was considered trustworthy. After this incident, more people are discussing whether automatic updates should be disabled, version differences should be manually reviewed, or manufacturers should provide stronger signature verification. Some comments mentioned that similar risks are not limited to Cursor; any third-party market based on the VS Code ecosystem may face the same problem. The key is whether there is the ability to perform identity and integrity checks at every stage of the release process.

Fourth, sympathy and concern for affected users. Some comments pointed out that many developers have large amounts of keys, API tokens, and production environment configurations saved on their work computers. Once SSH backdoors are implanted, the impact can be far greater than just a single extension. Others reminded that ordinary developers are not security experts, and it is unrealistic to require each user to manually review extension updates. Ultimately, it still requires platforms to provide more reliable release guarantees.

Fifth, calls for supply chain security measures. Some netizens mentioned that similar incidents have occurred multiple times in the software supply chain, from npm to PyPI to VS Code extension markets. The core problem is that the release threshold is too low and the operating permissions are too high. The most popular solutions include: mandatory two-factor authentication on the publisher side, signature of extension packages, content auditing on the marketplace side, and minimum permission sandboxes at runtime. Whether these suggestions will be adopted by Cursor and other markets will directly affect developers’ trust in third-party extension markets in the future.

Three things ordinary users can do

1. Confirm the installation source and version. Open the extension panel in Cursor or VS Code and check the version number of anthropic.claude-code. If you installed or updated to 2.1.312 / 2.1.313 from the Cursor Marketplace between 02:27–13:35 PT on October 29th, it should be considered high-risk. If you don’t remember the source, verify that the publisher field in the extension is anthropic.claude-code and review the installation logs or marketplace history. For other extensions, it is also recommended to check for any abnormal update records after this time period. If unsure, temporarily disable automatic updates and manually install versions from official channels. Cursor users can view the installation source on the extension details page; if Marketplace is listed as a Cursor-owned source, those who updated during the time window should investigate.

2. Check for residual issues on the host. Focus on whether the Ed25519 public key annotated with svc-telemetry is present in ~/.ssh/authorized_keys; check for suspicious files such as .smt, .smtk, and smt.cmd in ~/.config/; also search for network records connecting to 134.209.82.225:8099. On macOS, check the ~/Library/LaunchAgents directory; on Windows, examine task plans and the Startup folder; on Linux, check crontab and systemd user units to see if there are any suspicious entries. If unknown LaunchAgents or scheduled tasks are found, even if their names seem normal, disable them first before tracing the origin. After cleaning, it is recommended to restart the system to see if the suspicious processes or startup items reappear.

3. Do not uninstall extensions after cleaning. Since persistent scripts remain outside the extension directory, affected users should rotate SSH keys, cloud credentials, and important account passwords. If it cannot be determined whether persistence has been implanted, it is better to take excessive measures rather than hope for luck. If production code has run on this machine or sensitive keys have been accessed, prioritize isolating and reinstalling the system instead of simply deleting extensions and continuing use. Corporate users should also check CI/CD pipelines, Docker image build machines, and shared development machines to prevent lateral spread. Finally, it is recommended to include this incident in the team’s emergency drills, clarify the extension installation whitelist, and establish a key rotation process. Before reinstalling the system, export necessary project code and configuration files, and avoid restoring potentially infected setup directories from backups.

Conclusion

The Claude Code backdoor incident is not simply an instance of malicious extensions being uploaded; it is a typical case of the third-party extension market supply chain being breached. Anthropic’s official channels and code repository have not been compromised; what has been compromised is Cursor Marketplace’s control over publisher identities. With 5,000 users, a 11-hour window, and module loading triggering immediately, these numbers illustrate that in a high-privilege environment like IDE plugins, once the automatic update trust chain breaks, the consequences can quickly escalate.

Currently, the malicious version has been removed from the marketplace, the marketplace has been rebuilt, and the attacker’s server has been taken down. However, this is only the end of the incident response; it is not the starting point for the risk to disappear. For ordinary users, the most practical lesson is that expanding the market and automatic updates are not inherently trustworthy. When necessary, it is important to return to local evidence for judgment. Maintaining skepticism, keeping logs, and regularly rotating keys are the most practical self-protection strategies for developers in the current expansion ecosystem. For the industry, this incident once again shows that supply chain security cannot rely solely on manufacturers’ response speed; it also requires more solid design in terms of release permissions, signature verification, and isolation during extension runtime. Next time, any popular extension could be breached; the real problem is not how fast malicious packages can run, but whether our development environment still默认 trusts every update under official banners. With AI programming assistants becoming increasingly integrated into development environments, this trust issue deserves repeated questioning.

Reference Sources

• Phorion Blog: Official Claude Code VSIX Compromise (2026-10-30)
• Cursor Security Bulletin (2026-10-29)
• Hacker News Discussion: Claude Code extension backdoor on Cursor Marketplace
• Anthropic employee response on Hacker News

Author: Yongliang