critical severityConfidence highHistorical record

Tampered Claude Code 2.1.313 in Cursor's extension marketplace planted a persistent SSH backdoor on developer machines

Direct answer

Tampered Claude Code 2.1.313 in Cursor's extension marketplace planted a persistent SSH backdoor on developer machines, also tracked as Anthropic.claude-code 2.1.313 / Claude Code VS Code extension compromise / Cursor marketplace Claude Code backdoor is a critical-severity threat campaign HOL Guard tracked from Oct 29, 2026 to Oct 30, 2026, verified against 7 primary sources and last reviewed Oct 30, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

Between about 09:27 and 20:35 UTC on 2026-10-29, the Cursor VS Code extension marketplace served a maliciously modified Anthropic.claude-code version 2.1.313 that Anthropic did not build. Cursor says at most 5,000 users were affected. A 66-line loader prepended to extension.js runs when the extension loads: it appends an attacker Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to [email protected][.]225 that retries about every 60 seconds, installs persistence (macOS LaunchAgent com.apple.sysmond, Linux @reboot crontab, Windows SysMon scheduled task or Startup sysmon.cmd), and POSTs host details, Git email and up to 40 secret-looking environment variable names to hxxp://134.209.82[.]225:8099/beacon. Cursor says enabling SSH fails without admin rights on most macOS and Windows hosts, but the key, persistence and beacon still happen. Cursor removed the version, shut down and rebuilt its marketplace, rotated keys and had the C2 server taken offline. Clean 2.1.314 was published on 2026-10-30.

Also tracked as Anthropic.claude-code 2.1.313 · Claude Code VS Code extension compromise · Cursor marketplace Claude Code backdoor · svc-telemetry SSH key · Claude Code extension Open VSX backdoor

First observed
Oct 29, 2026
Last observed
Oct 30, 2026
Last reviewed
Oct 30, 2026
Tracking ended
Oct 30, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Sources disagree on Open VSX. Cursor and OpenSourceMalware (after Cursor contacted it) place the origin in the Cursor marketplace and say the Open VSX and Visual Studio Marketplace builds were not malicious. StepSecurity says 2.1.313 was published to Open VSX and mirrored into Cursor. Open VSX returns 404 for 2.1.313, which fits either account. How the package entered the marketplace is not public. Cursor's indicators list only darwin-arm64 and win32-x64 packages; whether a modified Linux package was served is unconfirmed, though the loader has a Linux code path.

  • Visual Studio Marketplace users of Claude Code in Microsoft VS Code are not listed as affected by Cursor or OpenSourceMalware.
  • The @anthropic-ai/claude-code npm CLI is not affected per OpenSourceMalware.
  • Cursor users who did not install or update to 2.1.313 during the 2026-10-29 window, and other Cursor marketplace extensions, are not affected per Cursor's audit.
  • On most macOS and Windows hosts without admin rights the SSH enable step fails, so the attacker could not log in through the tunnel; the key, persistence and beacon still happened.
  • This is a tampered marketplace package, not a vulnerability in Claude Code, and has no CVE ID.
  • HOL Guard checks AI agent actions; it does not inspect IDE extension code that runs at load time and would not have blocked this loader.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping or campaign-specific policy guidance is published for this record.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Update

    Clean Anthropic.claude-code 2.1.312 published to Open VSX, per StepSecurity.

    Source:StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor

  2. First observed

    Maliciously modified Anthropic.claude-code 2.1.313 becomes available in the Cursor VS Code extension marketplace (about 2:27am PT).

    Source:Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace

  3. Registry action

    Cursor removes 2.1.313 (about 1:35pm PT), blocks distribution and shuts down its marketplace as a precaution, then audits, rotates keys, rebuilds and restores it.

    Source:Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace

  4. Vendor action

    Clean Anthropic.claude-code 2.1.314 published to Open VSX; 2.1.313 returns not found.

    Sources:Open VSX: Anthropic.claude-code·StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor

  5. Update

    HOL Guard publishes an operator write-up with per-OS checks, Linux manual cleanup, scope notes and the Open VSX source disagreement.

    Source:HOL Guard operator write-up: Claude Code 2.1.313 SSH backdoor checks and cleanup

Publication clock: 0.1 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Anthropic.claude-code (Cursor extension marketplace)@2.1.313vscode-extensionpackage
  • Unauthorized authorized_keys entry, comment svc-telemetry@SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htksshconfig

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

5 indicators are recorded as not defanged. Treat them as live.

  • urlhigh confidencedefanged
    hxxp://134.209.82[.]225:8099/beacon
  • file hashhigh confidencenot defanged
    432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62
  • file hashhigh confidencenot defanged
    3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
  • file hashhigh confidencenot defanged
    ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
  • file hashhigh confidencenot defanged
    7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278
  • package namehigh confidencenot defanged
    [email protected]

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

Between about 09:27 and 20:35 UTC on 2026-10-29, the Cursor VS Code extension marketplace served a maliciously modified claude-code version HOL Guard tracked the campaign from Oct 29, 2026 to Oct 30, 2026.

No. Active tracking ended Oct 30, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 7 primary sources, names 2 reviewed artifacts, and was last fully reviewed Oct 30, 2026 by HOL Guard Security Publishing. 5 of its 6 indicators are recorded as not defanged and should be treated as live. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Sources disagree on Open VSX. Cursor and OpenSourceMalware (after Cursor contacted it) place the origin in the Cursor marketplace and say the Open VSX and Visual Studio Marketplace builds were not malicious.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-3373E5C4