Malicious Claude Code Extension With SSH Backdoor Slips Into Cursor Marketplace for 11 Hours
Cursor has confirmed that tampered Claude Code extension packages were distributed through its VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The altered builds targeted Windows and macOS users and attempted to plant an SSH backdoor, giving attackers a persistent remote foothold on affected developer machines.
According to Cursor's security notice, the compromised releases were published under the Anthropic.claude-code identifier, with version 2.1.312 among the affected builds. The incident is a reminder of how much trust developers place in extension marketplaces—and how quickly that trust can be exploited.
What Happened
Claude Code is Anthropic's agentic coding tool, and like many developer tools it ships as an extension for editors such as VS Code and Cursor. Cursor maintains a VS Code-compatible extension marketplace, which is where the malicious packages surfaced.
The tampered packages were not simply broken builds. They attempted to establish an SSH backdoor—a classic persistence technique that lets an attacker reconnect to a compromised host at will, often blending in with legitimate administrative traffic. Because SSH is a standard tool on developer workstations, a backdoor channel can be easy to overlook.
The window of exposure was short but meaningful: approximately 11 hours passed between the packages becoming available and their removal. For developers who auto-update extensions or who installed the affected version during that period, the risk is real and warrants immediate investigation.
Why Developer Endpoints Are High-Value Targets
Developer machines are among the most sensitive systems in any organization. They hold source code, credentials, cloud tokens, SSH keys, and often direct access to production infrastructure. A backdoor on a developer laptop or workstation can translate into access to private repositories, CI/CD pipelines, and cloud environments.
Extension marketplaces amplify this risk. Extensions run with the privileges of the editor, and many users install or update them without reviewing publisher signatures or release notes. Attackers understand this: compromising or impersonating a popular extension is a scalable way to reach a large population of technical users who are otherwise security-conscious.
Recommended Response
Cursor's disclosure gives defenders a concrete starting point. Teams should treat the affected version range as a potential compromise indicator and act accordingly:
- Inventory installations. Check Windows and macOS developer endpoints for the affected Anthropic.claude-code builds, including version 2.1.312, and confirm whether they were present during the exposure window.
- Hunt for SSH persistence. Review
authorized_keysfiles, SSH configuration changes, unusual listening services, and outbound SSH connections that do not map to known administrative activity. - Rotate credentials. Assume that secrets stored on affected machines—SSH keys, API tokens, cloud credentials, and repository access—may have been exposed. Rotate and re-issue them.
- Review extension policy. Consider pinning extension versions, restricting marketplace sources, and requiring review before updates land on developer endpoints.
- Check for lateral movement. Examine authentication logs for anomalous access from affected hosts into internal systems and cloud accounts.
The Bigger Picture
This incident fits a broader pattern of supply chain attacks aimed at the developer toolchain. From malicious npm and PyPI packages to compromised editor extensions, adversaries increasingly target the software and tools developers rely on rather than the applications they build. The lesson is consistent: the developer environment is part of the attack surface and deserves the same monitoring, least-privilege controls, and incident response readiness as production systems.
Marketplace operators also carry responsibility. Faster detection, stronger publisher verification, and clearer notification when malicious packages are identified all reduce the blast radius. Cursor's confirmation and version disclosure are a useful step, but the burden of detection still falls heavily on security teams.
For organizations using AI-assisted coding tools, the incident is a prompt to revisit how those tools are distributed and updated. Convenience features like automatic updates can turn a brief marketplace compromise into a fleet-wide exposure.
Conclusion
An 11-hour window may sound small, but for an SSH backdoor it is more than enough time to establish persistence. Security teams should verify whether the affected Claude Code builds reached their endpoints, hunt for signs of unauthorized SSH access, and rotate any credentials that may have been within reach. The incident underscores a durable truth: in modern software development, the toolchain itself is a target.
