Anthropic official VS Code extension backdoored for nearly 12 hours

On October 29, 2026, a trojanized update to Anthropic's official Claude Code VS Code extension (version 2.1.313) was pushed through Cursor's marketplace under Anthropic's legitimate publisher ID, impacting up to 5,000 developers. The malware attempts to establish a persistent SSH backdoor, collect environment variables, and exfiltrate host data. Cursor shut down its marketplace to remove the package, while Anthropic denied any internal breach.

Scope and distribution of the compromised update

• ▪The compromised Claude Code extension update version 2.1.313 was distributed exclusively through Cursor's marketplace and did not affect Open VSX or Microsoft's official VS Code Marketplace
• ▪The compromised Anthropic Claude Code extension version 2.1.313 was published under Anthropic's legitimate publisher identity anthropic.claude-code
• ▪The malicious Claude Code extension update version 2.1.313 was available for approximately 11 hours between 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, impacting at most 5,000 Cursor users

Malicious payload mechanisms and exfiltration

• ▪The malicious Claude Code extension version 2.1.313 attempts to establish a reverse SSH tunnel to IP address 134.209.82.225 and transmits host reconnaissance data to port 8099 over unencrypted HTTP
• ▪The malicious Claude Code extension version 2.1.313 exfiltrates host details including IP address, username, hostname, global Git email, and the names of up to 40 environment variables containing sensitive keywords like AWS, GCP, KEY, TOKEN, SECRET, or PASS
• ▪The reverse SSH tunnel script in the malicious Claude Code extension version 2.1.313 requires administrator rights on macOS and Windows hosts, causing the tunnel step to fail on systems where those permissions are absent
• ▪The malicious Claude Code extension version 2.1.313 inserts a 66-line loader into its JavaScript bundle that adds an attacker-controlled key labeled svc-telemetry to the user's ~/.ssh/authorized_keys file

Cursor response and remediation actions

• ▪Cursor rotated its marketplace keys and collaborated with a cloud hosting provider to block connections to the Claude Code extension attacker's server at 134.209.82.225
• ▪Cursor temporarily shut down its entire VS Code extension marketplace to remove the malicious Claude Code extension package version 2.1.313 and conduct safety checks

Statements on the source of the compromise

• ▪Anthropic technical staff member Felix Rieseberg stated that the Claude Code extension supply chain incident did not involve a breach or compromise of Anthropic's internal systems or employee laptops
• ▪Phorion CTO Luke Roberts characterized the Claude Code extension incident as a supply-chain compromise where the attacker obtained access to the official distribution channel on Cursor
• ▪Neither Cursor nor Anthropic has publicly explained the precise method or credential compromise through which attackers gained access to publish to Anthropic's official publisher account during the October 29, 2026, incident
• ▪Anthropic stated that an unauthorized third party used access to Cursor's marketplace to publish the tampered Claude Code extension copy which Anthropic did not build or publish