Malicious Claude Code Extension Plants Persistent SSH Backdoor

On 29 October 2026, Cursor reported a tampered copy of the Claude Code extension (anthropic[.]claude-code, versions 2.1.313 and 2.1.312) was briefly available in the Cursor extension marketplace in a supply-chain attempt targeting Cursor users. Microsoft confirms the malicious packages were never published or distributed from Microsoft Visual Studio Marketplace or from npm @antropic-ai/claude-code, and Anthropic told Microsoft their systems were not compromised nor involved in developing the malicious package.

At present, evidence points to the incident being confined to Cursor’s marketplace, with the attacker attempting to inject a loader into the extension that executes before normal code.

Microsoft Threat Intelligence analysed the injected JavaScript and found that the loader, once the extension module loads, seeks to collect host details, install an SSH key, enable a local SSH service, establish a reverse SSH tunnel, configure startup persistence, and report host information. The reverse SSH forwarding uses two identities: a public key added to the user’s authorized_keys and a private key used for the outbound tunnel connection.

The operation intends to make the workstation reachable via a tunnel, though practical access depends on host privileges and server configuration; the loader may still write keys and persistence artefacts even if the tunnel cannot be used. Platform-specific persistence attempts include macOS LaunchAgents, Linux user-crontab @reboot entries, Windows startup scripts or a SysMon task, and cross-platform startup scripts, all designed to relaunch the connection.

Mitigation involves identifying affected systems, preserving artefacts, cleaning up the injected components, and rotating credentials, with Cursor publishing remediation scripts and Microsoft Defender XDR detections available for guidance.