At most 5,000 users installed a malicious version of the official Anthropic Claude Code VS Code extension after the Cursor Marketplace was compromised, Cursor said.
Scope, timeline, and immediate remediation
Cursor disclosed that "a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace" impacted at most 5,000 users who installed the malicious package between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. Cursor briefly took down the marketplace to remove the malware and said it will be reaching out to impacted users directly.
As of October 30, 2026, the malicious version has been removed, and Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace.
How the compromised package worked
The package presented itself as anthropic.claude-code version 2.1.313, but researchers found its main JavaScript bundle "contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
Once activated after VS Code startup and when the extension's webview opened, the malicious loader performed the following actions:
- Added an attacker-controlled SSH key to the user's "~/.ssh/authorized_keys" file. The key was labeled "svc-telemetry" to appear benign.
- Attempted to make the machine reachable over SSH across Windows, Linux, and macOS and to establish a reverse tunnel to 134.209.82.225.
- Installed platform-specific persistence mechanisms — a scheduled task on Windows, a crontab on Linux, and a LaunchAgent on macOS.
- Sent host reconnaissance data over an unencrypted HTTP request to 134.209.82.225:8099/beacon.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadWhat data the malware collected and the operational risk
The extension transmitted host reconnaissance that included the public IP (queried from api.ipify[.]org), hostname and local username, operating system and CPU architecture, the home directory and current working directory, global Git email (from git config --global user.email), and names of up to 40 environment variables whose names contained KEY, TOKEN, SECRET, PASS, AWS, or GCP.
"Environment-variable values are not placed directly in the initial beacon," researcher Paul McCarty said. "Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly."
Observers reported no other follow-on payloads to date. Still, the reverse tunnel behavior creates a pathway to a victim's SSH service that would allow an operator to issue commands or transfer files if interactive access were achieved.
Why interactive SSH access was not guaranteed on all hosts
Cursor’s analysis notes a critical constraint: "Turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts." On those hosts, the step to enable local SSH failed, preventing the attacker from logging in through the tunnel. The extension, however, still added the attacker's SSH key, installed persistence, and sent host details to the operator — leaving follow-up risk even where interactive access failed.
What affected users should do and what Cursor and Anthropic have done
Cursor and public reporting recommend that users who installed the compromised extension during the identified window isolate affected hosts, remove the unauthorized SSH key labeled "svc-telemetry" from authorized_keys, and remove the persistence mechanisms (scheduled task, crontab, LaunchAgent). Users should also rotate credentials and active sessions. Cursor said it will contact impacted users directly, and Anthropic has reissued the extension as version 2.1.314.
How technologists, procurement leaders, and end users are likely to respond
- Technologists and security teams: Expect immediate host hunts for the "svc-telemetry" key, checks for scheduled tasks/crontabs/LaunchAgents, and network indicators such as connections to 134.209.82.225:8099/beacon. Teams should treat the presence of the key and persistence as a compromise even where SSH login failed.
- Procurement and platform owners: The incident highlights risks tied to third-party extension registries and marketplaces. Platform teams will need to review marketplace integrity and developer account protections, especially for packages that auto-update.
- End users and developers: Anyone with Claude Code set to auto-update is at heightened risk — "anyone who has their Claude Code instance set to auto-update could have consumed the malware," Gile warned — and should follow isolation and rotation steps if they installed the extension during the window.
The disclosure follows another supply-chain compromise disclosed a little over a week earlier, in which attacker-modified binaries replaced release artifacts for OVHcloud's CLI after a contributor's GitHub account was hijacked as part of the GlassWorm operation. In the Claude Code case, researchers say the malicious package was delivered through a compromised Cursor marketplace listing rather than through Anthropic's code.
The immediate containment — removal of the malicious package and publication of a clean 2.1.314 release — reduced the window of exposure, but the presence of an implanted SSH key and platform persistence means cleanup and credential rotation remain essential for affected hosts. Cursor has stated it will notify impacted users directly.
