Security researchers from OpenSourceMalware have uncovered a trojanized version of the official Claude Code extension published by Anthropic that was distributed through the Cursor IDE marketplace. The malicious update carried version number 2.1.313 and was presented to users as a routine release from the legitimate publisher.
The compromised package contained a 66-line loader inserted before the original extension code. Upon execution and opening of the extension’s webview, the malware appended an attacker-controlled SSH key labeled svc-telemetry to the file ~/.ssh/authorized_keys. It then attempted to establish a reverse SSH tunnel to the IP address 134.209.82.225, installed persistence mechanisms, and sent host reconnaissance data via HTTP to 134.209.82.225:8099/beacon.
Collected information included the public IP address obtained from api.ipify.org, hostname, local username, operating system and architecture, home and working directories, the user’s Git email address, and the names of up to 40 environment variables containing the strings KEY, TOKEN, SECRET, PASS, AWS, or GCP. Actual values of those variables were not transmitted in the initial beacon.
The attack window lasted approximately eleven hours on 29 October 2026 between roughly 10:27 and 21:35 UTC. Cursor stated that no more than 5,000 users installed the malicious version and confirmed that the compromise was confined to its own marketplace; neither Open VSX nor the Microsoft VS Code Marketplace were affected.
Cursor immediately removed the malicious package, rebuilt the marketplace, rotated cryptographic keys, and worked with its hosting provider to take the attacker server offline. The company also noted that enabling the local SSH service typically requires administrative privileges that the malware lacked on most macOS and Windows systems.
Users who installed or updated Claude Code during the affected period are advised to isolate affected hosts, remove the unauthorized SSH key and any persistence artifacts such as scheduled tasks, crontab entries, or LaunchAgents, install the clean version 2.1.314, and rotate any credentials referenced in environment variables.
