A tampered version of the Claude Code extension, identified as versions 2.1.313 and 2.1.312, was distributed through the Cursor extension marketplace for nearly 12 hours on October 29, 2026. The malicious package, which appeared under Anthropic’s official account, was active from approximately 2:27 AM to 1:35 PM Pacific Daylight Time. Microsoft Security Research confirmed that the incident was isolated to the Cursor marketplace and did not affect the official Visual Studio Marketplace or the npm distribution of the extension.
The injected JavaScript loader executed before the extension’s standard initialization, allowing it to perform host reconnaissance and establish persistence. According to Microsoft, the malware collected system details including the hostname, username, operating system, architecture, and home directory. It also scanned for environment variables containing sensitive terms such as AWS, GCP, or SECRET, transmitting the names of these variables to an attacker-controlled server to help prioritize future targets.
To maintain access, the malicious code attempted to append an attacker-controlled Ed25519 public key to the user’s authorized_keys file and enable the local SSH service. It further configured a reverse SSH tunnel to allow remote access to the workstation. Persistence was attempted through platform-specific mechanisms, including LaunchAgents on macOS and scheduled tasks on Windows, with background scripts designed to retry the connection every 60 seconds.
While the backdoor was designed to operate across Windows, macOS, and Linux, security researchers noted that coding flaws prevented the tunnel from functioning in some instances. Furthermore, the backdoor generally required specific host privileges to succeed, though the loader could still write persistence artifacts even when the tunnel connection failed. Cursor personnel worked with the hosting provider to disable the attacker's server and removed the malicious extension from the marketplace.
Anthropic has confirmed that its internal systems were not compromised and that it did not develop the malicious package. Despite the distribution of a legitimate version 2.1.314 to replace the compromised files, security experts warn that simply updating the extension does not remove existing backdoors or persistence mechanisms. Users who had the extension installed during the window of exposure are advised to audit their systems for unauthorized SSH keys and rotate potentially exposed credentials.