{
  "entry": {
    "kind": "vuln",
    "slug": "trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace",
    "name": "trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace",
    "vendor": "anthropic.claude-code",
    "description": "On 29 October 2026, from about 09:27 to 20:35 UTC, Cursor's own extension marketplace served a tampered build of the official Claude Code for VS Code extension, anthropic.claude-code 2.1.313, under the legitimate extension ID; Cursor says at most 5,000 users installed it. A loader of about 66 lines prepended to the real extension code appends an Ed25519 key with the comment svc-telemetry to ~/.ssh/authorized_keys, tries to enable SSH remote login, opens a reverse SSH tunnel to 134.209.82.225 (reported on ports 22 and 8099), and sends host recon including the names, not the values, of up to 40 credential-like environment variables. It installs persistence that runs without the editor: on macOS a LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist (not an Apple component) with ~/.config/.smt and ~/.config/.smtk; on Windows a SysMon scheduled task and a sysmon.cmd Startup script; on Linux an @reboot cron entry. Early reports named Open VSX, but Anthropic says 2.1.313 was never published to Open VSX, the Visual Studio Marketplace or npm, and Microsoft confirmed its Marketplace and npm were clean, so VS Code installs from the Microsoft Marketplace are not affected. Anthropic says its own systems were not compromised and skipped to 2.1.314. Cursor removed the build, rebuilt its marketplace after rotating keys and had the C2 server taken offline. How the attacker got publishing access has not been disclosed.",
    "website": "https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ide-extension",
    "updatedAt": "2026-10-30",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace",
      "aliases": [
        "ti-168"
      ],
      "title": "Trojanized Claude Code Extension 2.1.313 in Cursor's Marketplace Planted an SSH Key, a Reverse Tunnel and Persistence That Survives Uninstall",
      "summary": "On 29 October 2026, from about 09:27 to 20:35 UTC, Cursor's own extension marketplace served a tampered build of the official Claude Code for VS Code extension, anthropic.claude-code 2.1.313, under the legitimate extension ID; Cursor says at most 5,000 users installed it. A loader of about 66 lines prepended to the real extension code appends an Ed25519 key with the comment svc-telemetry to ~/.ssh/authorized_keys, tries to enable SSH remote login, opens a reverse SSH tunnel to 134.209.82.225 (reported on ports 22 and 8099), and sends host recon including the names, not the values, of up to 40 credential-like environment variables. It installs persistence that runs without the editor: on macOS a LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist (not an Apple component) with ~/.config/.smt and ~/.config/.smtk; on Windows a SysMon scheduled task and a sysmon.cmd Startup script; on Linux an @reboot cron entry. Early reports named Open VSX, but Anthropic says 2.1.313 was never published to Open VSX, the Visual Studio Marketplace or npm, and Microsoft confirmed its Marketplace and npm were clean, so VS Code installs from the Microsoft Marketplace are not affected. Anthropic says its own systems were not compromised and skipped to 2.1.314. Cursor removed the build, rebuilt its marketplace after rotating keys and had the C2 server taken offline. How the attacker got publishing access has not been disclosed.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise"
      ],
      "componentType": "ide-extension",
      "component": {
        "name": "anthropic.claude-code",
        "vendor": null,
        "package": null,
        "ecosystem": "vscode",
        "catalogSlug": "agent/cursor"
      },
      "affected": [
        {
          "range": "anthropic.claude-code 2.1.313 installed in Cursor from Cursor's extension marketplace (29 October 2026). 2.1.312 and 2.1.314 are reported clean; the Microsoft Marketplace, Open VSX and npm builds were not affected. Updating the extension does not remove the backdoor.",
          "fixed": "2.1.314"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-30",
      "modifiedAt": "2026-10-30",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/"
        }
      ],
      "mitigation": "Find every machine where Cursor has anthropic.claude-code 2.1.313 installed, or had it since 29 October, and treat it as compromised. Isolate it and preserve evidence first, then remove the svc-telemetry line from ~/.ssh/authorized_keys, the LaunchAgent, scheduled task, Startup script or cron entry and any running tunnel process, switch Remote Login back off, and update the extension to 2.1.314 or later; Cursor's published removal scripts do these steps and exit non-zero if anything remains. Block 134.209.82.225 at egress and search network logs for past connections. From a clean machine, rotate SSH keys, cloud CLI credentials, Git and registry tokens and AI provider keys the user could read, and review their cloud and Git audit logs from 29 October onward.",
      "detectedByAnomity": true
    }
  }
}