Cursor's Claude Code Extension Was Hijacked, Exposing 5,000 Developers to SSH Backdoor

A malicious build of the Claude Code extension appeared in Cursor's VS Code extension marketplace for roughly 11 hours and executed as soon as the editor activated it. The package attempted to establish persistent SSH access, collect host information, and connect to an attacker-controlled server. Cursor estimated that no more than 5,000 users were exposed before it removed the package, suspended the marketplace, and worked with the hosting provider to disable the server, according to its security notice .

An out-of-sequence version hid in plain sight

The compromised package identified itself as Anthropic.claude-code version 2.1.313 , which is absent from Anthropic's official release sequence. Current listings on Open VSX, Microsoft's Visual Studio Marketplace, and npm move from 2.1.312 to 2.1.314 . Cursor identifies 2.1.314 as the clean replacement.

Cursor and other VS Code derivatives, including Windsurf and VSCodium, rely on Open VSX because Microsoft's marketplace license restricts use to Microsoft products. That dependency placed an Open VSX artifact inside Cursor's distribution path.

A 66-line loader changed the package

A comparison with the legitimate extension found one modified file: extension.js . The attacker prepended a 66-line immediately invoked function to the authentic bundle. The function ran during extension activation without requiring a Claude conversation or other user action, while the legitimate features continued to work.

Enabling the local SSH service generally requires administrator rights, which Cursor lacks during a normal user session. Errors in the malicious code further limited that step on typical macOS and Windows systems. Hosts with SSH already enabled, or with Cursor running under elevated privileges, faced greater exposure. The key, user-level files, and some persistence mechanisms could still remain even when the SSH service failed to start.

Containment could not clean endpoints

Cursor removed version 2.1.313 , blocked further distribution, and temporarily shut down its marketplace. The company then audited access, rotated relevant keys, rebuilt the marketplace, and restored service. The hosting provider also took the attacker's command-and-control server offline.

Disabling the server interrupts the hardcoded connection path but leaves local modifications intact. Uninstalling the extension, updating it, or closing Cursor does not remove an SSH key, LaunchAgent, scheduled task, Startup script, or dropped payload file.

On macOS, this command checks whether the labeled SSH key remains in the current user's authorization file:

A clean result confirms only that the labeled key is absent from that file. It does not rule out deleted indicators, other user accounts, or remaining persistence files.

Cursor provides a macOS cleanup script that removes the key, LaunchAgent, and associated files. Windows users should follow the remediation steps in the official advisory . Cursor also recommends rotating credentials accessible from an affected host, using a known-clean machine.

Open VSX widened the trust boundary

The malicious artifact was traced to Open VSX, the open extension registry used by several VS Code forks. The namespace owner is listed as Anthropic employee Igor Kofman, but that account association does not establish who uploaded the package. Published evidence has not identified the compromise route. Possible paths include stolen publisher credentials, a leaked publishing token, or a compromised release pipeline.

A separate malicious Nx Console release also used editor distribution to target developer credentials and exfiltrate thousands of GitHub tokens. Editor extensions inherit access from the current user, including source trees, terminals, SSH configuration, package managers, and authenticated cloud tools. AI coding extensions often require broad workspace and shell access, increasing the damage a trojanized update can cause.

Check, clean, rotate, harden

1. Inventory installations. Check every device where the Claude Code extension may have run through Cursor, Windsurf, VSCodium, or another Open VSX client. Review extension inventories, caches, and endpoint telemetry for version 2.1.313 .
2. Isolate affected hosts. Disconnect systems that installed 2.1.313 and follow the organization's incident-response process before removing evidence. Run Cursor's remediation steps and reimage the machine if policy requires it.
3. Install a verified release. After remediation, install 2.1.314 or a later release verified against Anthropic's official distribution history.
4. Rotate reachable credentials. Replace GitHub tokens, cloud credentials, SSH keys, package-registry tokens, and other secrets available to the affected account. Perform the rotation from a clean device.
5. Review endpoint evidence. Search network and process logs for 134.209.82.225 , inspect SSH authentication records, and check LaunchAgent, scheduled-task, and Startup-script creation around the exposure window.
6. Tighten extension controls. Record each extension's registry source, allowlist high-privilege tools, stage automatic updates, and compare package hashes or bundle diffs before broad deployment.

A familiar publisher name and a functioning interface do not establish package integrity. Editor extensions execute with the developer's local privileges, so teams should review their provenance and update path with the same controls applied to other executable dependencies.