Trojanized Claude Code update on Cursor: cleanup and prevention

For about half a day on October 29, 2026, anyone who installed or auto-updated Claude Code from Cursor's extension marketplace could have received a build that planted an SSH backdoor. The package carried the genuine extension identifier, anthropic.claude-code, and arrived as an ordinary update. The live part of the attack has been shut down, but what it left on disk is still there until someone removes it. This article lays out what is known, where the reports disagree, how to clean up an affected machine, and what to change so the next tampered update does less damage.

What happened

According to The Hacker News, the tampered package identified itself as anthropic.claude-code version 2.1.313. Jenn Gile of OpenSourceMalware told the publication that its main JavaScript bundle held "a malicious 66-line loader inserted before the legitimate extension code." Cursor took its marketplace offline for a while to remove the package. It says at most 5,000 users installed the bad version, between about 2:27 a.m. and 1:35 p.m. Pacific time, and that it will contact them directly.

Nobody has said publicly how the attacker got the access to publish under Anthropic's name on Cursor's marketplace. The two companies describe their roles differently, and both accounts can be true at once:

• Cursor says the malicious version "was not developed by Anthropic" and that no other extension on its marketplace was altered. It reports that it rotated its keys, rebuilt the marketplace and had the attacker's server taken offline with the cloud provider.
• Anthropic says its own systems and employee laptops were not compromised. As The Hacker News reports its statement, an attacker used access to Cursor's marketplace to publish the tampered build, and the official channels were not affected.
• The Hacker News argues that Cursor's wording "misses the point": the code did not come from Anthropic, but users got it under Anthropic's real extension ID, not as a look-alike, so the name told them nothing.

Other distribution channels appear clean. The Hacker News cites Socket, which found no sign that 2.1.313 was ever publicly available on Open VSX or npm. It also cites Microsoft, which confirmed the version was never published on the Visual Studio Marketplace or in the anthropic-ai/claude-code npm package. The same article first reported that Open VSX was compromised and later corrected that. For scale, the Visual Studio Marketplace listing shows more than 29 million installs under the Anthropic publisher. The Hacker News gives 2.1.314 as the current clean release on the official channels.

Where the reports disagree

The two news accounts, from The Hacker News and Cyber Security News, differ on several details. Where they do, the safer choice is to assume the wider scope.

Detail	The Hacker News	Cyber Security News
Affected versions	2.1.313	2.1.312 and 2.1.313, per Cursor's notice as updated on October 30
Time available	"close to 12 hours," in Anthropic's account	11 hours and 8 minutes
Platforms	Attempts on Windows, Linux and macOS, with a crontab for persistence on Linux	Aimed at Windows and macOS users

Cyber Security News based its version list on Cursor's revised notice, so treat both 2.1.312 and 2.1.313 as bad. Check Linux machines too.

What the loader did

The two reports agree on how the loader worked. It ran when the extension loaded (The Hacker News says after editor startup and when the extension's webview opens) and then did the following:

1. It added an attacker-controlled public key to ~/.ssh/authorized_keys, labeled svc-telemetry so that it looks routine.
2. It tried to turn on the machine's SSH server.
3. It opened a reverse SSH tunnel to 134.209.82[.]225, which would let the attacker's server reach back into the victim's own SSH service.
4. It installed persistence. Cyber Security News names a macOS LaunchAgent called com.apple.sysmond and, on Windows, a scheduled task named SysMon running as SYSTEM, with a script in the Startup folder as a fallback. Background scripts retried the connection about every 60 seconds.
5. It sent an unencrypted HTTP POST to port 8099 at /beacon. The report contained the public IP address (looked up through api.ipify[.]org), the hostname and username, the OS and CPU architecture, the home and working directories, the global Git email, and the names of up to 40 environment variables containing strings such as KEY, TOKEN, SECRET, PASS, AWS or GCP.

The beacon sent variable names, not their values. Researcher Paul McCarty notes that the names still reveal which cloud providers and credential types a machine uses, and that working SSH access would let the operator look at the account directly. No follow-on payloads have been observed.

How far the loader got depends on the host. As The Hacker News quotes Cursor, turning on the SSH service requires admin rights, which the extension lacks on most macOS and Windows hosts. On those machines the attacker "could not have logged in through the tunnel." Cyber Security News adds that bugs in the malicious code also got in the way. Neither limit stopped the key, the persistence or the beacon. On a Linux workstation that already runs an SSH server, the admin-rights obstacle may not apply at all.

Finding out whether you are affected

A machine is in scope if it ran Cursor with Claude Code installed during the October 29 window, especially with automatic extension updates on. In the Extensions view, check the version that was installed then, not only the current one. The Claude Code VS Code documentation says the extension's version number matches the Claude Code version it bundles. The same page explains that running claude in an editor's integrated terminal reinstalls the extension automatically. A developer may therefore have the extension without ever installing it on purpose, so ask about the CLI as well as the extension.

Then look for the indicators. Cursor's published list, as summarized by Cyber Security News, contains the address 134.209.82[.]225, SSH connections on TCP port 22, HTTP POSTs to port 8099 at /beacon, and the svc-telemetry key. Search firewall, proxy and endpoint logs for that address from the morning of October 29 onward.

Cleaning up an affected machine

Microsoft's research team, quoted by The Hacker News, makes the central point: "Removing or updating the extension does not remove artifacts written outside its installation directory." Updating to a clean version is necessary, but it does not clean anything up. Work through these steps in order.

1. Preserve evidence before you change anything: copy the authorized_keys files, export the scheduled task, and keep copies of the LaunchAgent, crontab and any unfamiliar startup scripts.
2. Isolate the host from the network if it shows signs that the payload ran.
3. Remove the artifacts: the key, the persistence entries, and the SSH service if you did not turn it on yourself.
4. Update the extension to a clean release from the official channel.
5. Rotate credentials and revoke sessions from a different, trusted machine.
6. Decide whether to rebuild. Cyber Security News says Cursor advises assessing whether affected machines need a fresh install. If you can't account for everything the machine did during the window, rebuilding is the conservative choice.

On Windows, these PowerShell commands check the known locations. Run them as an administrator so that the system-wide key file and the SYSTEM task are visible.

# Keys the loader may have added
Select-String -Path "$env:USERPROFILE\.ssh\authorized_keys" -Pattern 'svc-telemetry'
Select-String -Path "$env:ProgramData\ssh\administrators_authorized_keys" -Pattern 'svc-telemetry' -ErrorAction SilentlyContinue

# Persistence: the scheduled task (export it before deleting) and the Startup folder
Export-ScheduledTask -TaskName 'SysMon' -ErrorAction SilentlyContinue | Out-File sysmon-task.xml
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"

# Was the OpenSSH server installed or started? Any live connection to the address?
Get-Service sshd -ErrorAction SilentlyContinue
Get-NetTCPConnection -RemoteAddress 134.209.82.225 -ErrorAction SilentlyContinue

On macOS and Linux:

grep -n 'svc-telemetry' ~/.ssh/authorized_keys
ls -l ~/Library/LaunchAgents/ | grep -i sysmond   # macOS
launchctl list | grep -i sysmond                  # macOS
crontab -l                                        # Linux and macOS: look for entries you did not add

Delete the svc-telemetry line, not the whole file, unless you have confirmed every other key in it. Remove the task, LaunchAgent or cron entry, and the script it starts. If the SSH server is running and nobody needs it, stop and disable it.

The servers behind the workstation

To anyone who runs servers, a developer's workstation matters mainly as a way in to everything else. It holds SSH keys, cloud tokens and deployment credentials. The beacon's list of environment variable names works as a list of what to rotate: each name points to a secret that was on the machine. Replace any SSH private keys that lived in that account, remove the old public keys from the authorized_keys files on your servers, and check your servers' authentication logs for logins from addresses you don't recognize since October 29. Do the rotation from a machine that was not exposed. Otherwise the new secrets end up on a host you don't yet trust.

Making the next one less damaging

This attack did not rely on a look-alike name or a typo. It used the real extension ID, delivered through a trusted update channel. Checking the name before installing would not have caught it. What helps is limiting what a bad update can do and noticing quickly when one gets through.

• Know which registry each editor uses. The same extension ID lives in several registries. The Claude Code documentation sends VS Code users to Microsoft's marketplace, links a separate Cursor install, and points other VS Code forks to Open VSX. Only one of those registries was compromised. A trusted ID in one registry tells you nothing about the copy in another.
• Weigh automatic updates on sensitive machines. "Anyone who has their Claude Code instance set to auto-update could have consumed the malware," Gile told The Hacker News. On workstations with access to production, consider turning off automatic extension updates (in VS Code this is the extensions.autoUpdate setting, so check what your fork offers) and installing updates a day or two after release. The cost is that real security fixes reach you later too.
• Control reinstalls. If you remove the extension, the documentation says you can stop the CLI from putting it back by setting autoInstallIdeExtension to false or CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL=1.
• Keep developers off admin accounts. In this case, the missing admin rights are what kept the tunnel from working on most Windows and macOS machines.
• Don't run an SSH server on a workstation unless it needs one. Watch every authorized_keys file for changes, on workstations as well as servers.
• Watch outbound traffic. This loader sent its data out over the network: an IP lookup service, a raw IP address on port 8099, and an SSH session to an unfamiliar host. On a machine where you know what normal traffic looks like, each of these stands out.

Watching a Windows machine with outbound-watch

For Windows workstations, outbound-watch is a small open-source program that lists every outgoing connection. For each one it shows the program, the name that was looked up, the address, the network and country, and the bytes sent and received. It keeps these as history. You write "expected lists" of where programs normally connect, and the tray icon tells you when a program connects somewhere else.

Lists are made of rules, one per line, and every word on a line must match. A starting point for a developer machine might look like this, with the placeholders replaced by what you actually observe over a few normal days:

# Editors: narrow to the destinations you see in normal use
process Code.exe,Cursor.exe port 443 host *.example.com
# SSH only to your own servers
process ssh.exe ip 203.0.113.0/24 port 22

With rules like these, a beacon from the editor to a bare IP address on port 8099 would be flagged as unexpected. So would an SSH session to an outside address, if the OpenSSH client carries it. Two details from the project's README matter here. First, run it as an administrator: without admin rights it misses TCP connections that open and close within a second, as well as UDP traffic and the names programs looked up. Second, it only records from the moment it starts, so it can't reconstruct October 29 on a machine where it wasn't already running. It is for catching the next incident, not for investigating this one.

Note
From Strongthium Labs. For the Linux servers your developers' workstations connect to, Strongthium Guard locks them down, reads their logs and shuts out whoever attacks them within seconds. Strongthium Guard: a firewall that bans attackers by itself. Locks down your Linux servers, reads their logs and shuts out whoever attacks them - within seconds.

Sources

• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - The Hacker News
• Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours - Cyber Security News
• Use Claude Code in VS Code - Anthropic
• Claude Code for VS Code - Visual Studio Marketplace - Microsoft
• GitHub - strongthium/outbound-watch - Strongthium Labs, on GitHub

---

First published on Strongthium Lab Notes.