Malicious Claude Code update on Cursor: SSH persistence beyond the editor
A malicious version of the official Claude Code extension reached users through Cursor Marketplace as an apparently legitimate update. According to researchers cited by The Hacker News, version 2.1.313 appeared under the legitimate publisher identity. Cursor temporarily closed its marketplace to re
Posted on Nov 3 • Originally published at tmgs.vn
A malicious version of the official Claude Code extension reached users through Cursor Marketplace as an apparently legitimate update. According to researchers cited by The Hacker News, version 2.1.313 appeared under the legitimate publisher identity. Cursor temporarily closed its marketplace to remove the compromised package.
The extension was designed to activate after VS Code started and when its webview opened. It added an attacker-controlled key to the user's SSH authorized_keys file, attempted to enable SSH access, established reverse tunnels, and installed persistence through scheduled tasks, crontab or LaunchAgent, depending on the operating system. It also sent host reconnaissance data over unencrypted HTTP.
According to Cursor, enabling the SSH service required administrator privileges and usually failed on macOS and Windows unless Cursor ran with those privileges. However, SSH keys and persistence mechanisms were installed even when that step failed. Removing the extension therefore does not establish that the machine is clean.
The malicious release was reported only through Cursor Marketplace; there was no evidence of distribution through Open VSX or Microsoft VS Code Marketplace. How the unauthorized update entered the distribution system remains unclear.
Cursor reported up to 5.000 affected users who installed it between 2:27 a.m. and 1:35 p.m. Pacific time on 29/10/2026. This count does not establish that backdoor access succeeded on every machine.
As of 30/10/2026, the malicious release had been removed, and Anthropic had released version 2.1.314 on Open VSX and Microsoft VS Code Marketplace.
TMGS recommends identifying exposed machines by extension version, installation source and installation time, with explicit time zones in logs. Isolate suspect machines and preserve evidence before cleanup. Review unfamiliar SSH keys, persistence mechanisms, SSH activity and reverse tunnels; remove unauthorized components after verification. Revoke sessions, rotate potentially exposed credentials and check machines again after remediation. Assign responsibility for developer machines, including partner-managed devices with enterprise access.
Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/claude-code-gia-mao-va-dau-vet-ngoai-trinh-soan-thao-i.4f876629-d89e-4cc6-abe0-7f80511b3379