Compromised Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistence

Publisher preview

On October 29, 2026, Cursor disclosed that a maliciously modified version of the Anthropic.claude-code extension, version 2.1.313, was available in the Cursor VS Code Extension Marketplace between approximately 2:27 AM and 1:35 PM PT. The malicious version was not developed by Anthropic. According to Cursor, at most 5,000 users were potentially affected. The malicious code collects host and user information, adds an attacker-controlled SSH key (svc-telemetry) to authorized_keys, installs persistence, and attempts to enable the local SSH service and establish a reverse SSH tunnel. It also reports host details to 134[.]209[.]82[.]225:8099. Cursor removed the malicious version, shut down and rebuilt the marketplace, rotated its keys, and worked with the hosting provider to take the attacker server offline. Cursor says it audited access and found no evidence that other extensions were tampered with. Importantly, uninstalling the malicious extension may not be sufficient, because the payload drops standalone persistence scripts that can continue running after the extension is removed. Claude Code is Anthropic’s AI coding tool. Cursor, an AI code editor built on VS Code, distributes the Claude Code extension through its own VS Code extension marketplace. It was this marketplace—not Anthropic’s official distribution—that was compromised and used to distribute the malicious build.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.