Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
A tampered Claude Code extension was briefly distributed through Cursor’s marketplace and attempted to establish persistent remote access.
TL;DR
- Microsoft Security said a modified Claude Code extension, versions 2.1.312 and 2.1.313, appeared in Cursor’s extension marketplace on October 29. Cursor said the affected listing was available for several hours and reached at most 5,000 users.
- Microsoft’s analysis describes code that attempted to add an attacker-controlled SSH key, enable local SSH access, establish reverse forwarding and preserve access.
- Ars Technica reported that the malicious package was distributed through Cursor’s marketplace under Anthropic’s official publisher identity.
Microsoft Security said a modified Claude Code extension, versions 2.1.312 and 2.1.313, appeared in Cursor’s extension marketplace on October 29. Cursor said the affected listing was available for several hours and reached at most 5,000 users. [1] [2]
Microsoft’s analysis describes code that attempted to add an attacker-controlled SSH key, enable local SSH access, establish reverse forwarding and preserve access. The company said the payload also reported host details. [1] [2]
Ars Technica reported that the malicious package was distributed through Cursor’s marketplace under Anthropic’s official publisher identity. Anthropic and Cursor said their official extension channels were not affected; the incident was limited to the Cursor marketplace. [1] [2]
The published accounts do not establish how the marketplace listing was altered or whether any user machine was successfully accessed. Microsoft noted that defects prevented the backdoor from working in some cases, so exposure and confirmed compromise should not be treated as the same thing. [1] [2]
Why it matters
The incident places extension marketplace provenance and publisher controls in the security boundary for AI coding tools. It also shows why a familiar publisher label alone cannot establish that a package was built and distributed through the publisher’s own channel.
Editor's note
Microsoft’s technical analysis and Ars Technica’s reporting agree on the affected marketplace and limited distribution window; successful remote access was not established.