Fake Anthropic Claude Code in Cursor’s marketplace planted an SSH backdoor
independently tested source re-read 2026-11-02
Why this label: Primary disclosure is Cursor’s own security notice. Microsoft Threat Intelligence published a separate malware analysis of the injected loader (attack chain, persistence, IOCs) the next day, so this card uses the independently tested label. We reproduced nothing ourselves and did not run the remediation scripts.
- Tried
- Install or auto-update Anthropic.claude-code from the Cursor VS Code Extension Marketplace on macOS or Windows during the Oct 29, 2026 window (~2:27am–1:35pm PT).
- Broke
- Cursor says those two versions ran injected code that collected host/user details (including env-var names), appended an attacker SSH key labeled svc-telemetry, attempted to enable local SSH and open a reverse tunnel, and wrote LaunchAgent / scheduled-task / Startup persistence outside the extension folder. Cursor notes SSH enablement needs admin rights and failed on most macOS/Windows hosts because of errors in the malware, but the key, persistence, and host-detail beacon still ran. Uninstalling the extension may leave those artifacts running.
- Cause
- confirmed Cursor’s security notice (2026-10-29, IOC update 2026-10-30): malicious Anthropic.claude-code 2.1.312 and 2.1.313 were available on the Cursor marketplace for that window; Anthropic did not develop them; other Cursor marketplace extensions and SpaceXSI products were not reported impacted.
- confirmed Microsoft Threat Intelligence (2026-10-30) independently analyzed the injected JavaScript: reconnaissance, svc-telemetry authorized_keys entry, reverse SSH forwarding, platform persistence (com.apple.sysmond LaunchAgent / Linux crontab / Windows SysMon task), and a delayed host-detail beacon. Microsoft states the packages were never on Visual Studio Marketplace or npm @anthropic-ai/claude-code, and Anthropic confirmed to Microsoft that Anthropic’s systems were not compromised.
- confirmed Cursor and Microsoft both say removing the extension is insufficient because persistence scripts live outside the extension directory; Cursor published platform remediation scripts and IOC lists.
- Fix
- Follow Cursor’s check: look for the svc-telemetry comment in ~/.ssh/authorized_keys (and Windows administrators_authorized_keys). If present, isolate the host, run Cursor’s remediate-macos.sh or remediate-windows.ps1 (Windows as Administrator), remove remaining IOCs from Cursor’s and Microsoft’s lists, rotate credentials/sessions from a clean machine, and rebuild the host when trust is gone. Do not treat uninstall alone as cleanup.
- Prevention
- Treat freshly published marketplace extensions as untrusted until they age: Cursor’s hardening guidance (cited by Microsoft) includes restricting publishers and an extension-install cooldown. Prefer pinning known-good extension versions, avoid auto-updating critical tools during an active incident window, and keep SSH authorized_keys reviewed.