Cursor Marketplace Compromise: SSH Backdoor in Claude Code 2.1.313

The Cursor Marketplace compromise put malicious anthropic.claude-code 2.1.313 online on 29 October 2026, according to an OpenSourceMalware analysis. The package kept the legitimate Claude Code interface and the official bundled binary. A 66-line loader in extension.js tried to enroll the developer machine into attacker SSH trust as soon as the extension module loaded. Victim count and any use of the tunnel remain unproven.

Was the Cursor Marketplace compromise a model breach or a host breach?

It was a developer-host compromise: a trojanized IDE extension. OpenSourceMalware describes anthropic.claude-code version 2.1.313, published to the Cursor Marketplace on 29 October 2026, as the official Claude Code listing in that marketplace and as compromised. The extension kept its normal interface. The bundled binary was the official binary. The file that differed was extension.js.

A VS Code-compatible extension host executes JavaScript with the permissions of the person who launched the IDE: it can read the home directory, spawn child processes, and open network connections. The durable damage is on the developer’s operating system.

A short prepend in extension.js is enough to attempt reconnaissance, rewrite SSH trust, and start a tunnel. A model evaluation or a jailbreak suite will not show a LaunchAgent, a crontab line, or a new Ed25519 key. Controls aimed at prompts never inspect authorized_keys.

Cursor told OpenSourceMalware that the Claude Code extension in the Cursor Marketplace experienced some form of compromise, and that this marketplace was the origin, not Open-VSX. Attacker identity is unknown. The source gives no victim count, no geography, and no confirmation that anyone used the SSH access. The provenance of the analyzed directory is not established.

The findings show that this specific artifact is malicious. They do not, by themselves, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised. How 2.1.313 was published, who published it, and whether Anthropic’s release process played any role are still open. Cursor’s statement is evidence about the Cursor Marketplace. It says nothing about the integrity of Anthropic’s build system.

A 66-line prepend defeats extension trust

The loader runs when the editor loads the extension module, including in a window where nobody has started a Claude chat. OpenSourceMalware describes a 66-line JavaScript loader inserted at the top of extension.js, ahead of the expected bundle. Waiting for a suspicious prompt is the wrong tripwire.

The package declares no install, build, prepare, preinstall, or postinstall scripts. Malicious behavior occurs at extension runtime rather than through a package-manager lifecycle hook. A scanner that only flags lifecycle scripts has an empty metadata field to inspect. Execution starts later, inside the editor, after the extension is already on disk.

The loader suppressed nearly every exception. When a malicious step failed, the legitimate Claude Code extension continued to load. The chat window can look normal while the key, the tunnel, and the autostart entry are already on disk. The unpacked tree otherwise matched a normal release, official bundled binary included. Hashing only the binary, or reading the marketplace page, misses the prepend.

Find the installed folder for anthropic.claude-code at version 2.1.313 in the editor’s extensions directory. Hash extension.js and keep the directory before you delete anything. Diff that file against a copy your team archived before 29 October 2026, or against a build from a channel OpenSourceMalware called clean. Confirm the file does not start with a standalone loader ahead of the real bundle. Block 2.1.313 until you can verify a replacement by hashing extension.js yourself. The source does not name a later Cursor Marketplace build as clean.

Package-manager scanning misses this loader because the malicious logic is extension-host JavaScript in a Cursor Marketplace build, not an npm lifecycle script. OpenSourceMalware lists three distributions as not malicious: the npm package @anthropic-ai/claude-code, the OpenVSX extension, and the Microsoft VS Code extension for Claude. Only anthropic.claude-code 2.1.313 from the Cursor Marketplace is in scope.

An allowlist that names a publisher still accepts a swapped bundle if it never hashes extension.js. The injected loader downloaded no second-stage executable. After a 1.5-second delay it queried public-IP services and sent collected JSON to 127.0.0.1 on port 8099 and to its server on port 8099, then drained the response and ignored it. Shell scripts and the tunnel key were generated or decoded from content already inside the extension. No blockchain indicators were found.

For context only, the same disguise appears in the 2018 event-stream dependency swap and in XZ Utils 5.6.0 and 5.6.1 (CVE-2024-3094). Activation here is IDE module load. An AI supply chain security audit that stops at weights, datasets, and plugins will miss a prepended extension.js. A related break is the malicious Git config that made coding agents run attacker code, because the editor followed local instructions with the user’s privileges.

How does SSH trust turn one laptop into durable access?

On load the implant recorded hostname, local username, operating system, CPU architecture, home directory, current working directory, and the global Git email from git config. It also collected the names of up to 40 environment variables whose names contained KEY, TOKEN, SECRET, PASS, AWS, or GCP. The source says the values were not placed in the initial beacon. Names still show which token and cloud variables exist on that laptop. A later session is a separate chance to read values, source trees, private keys, and cloud credentials. Rotate anything that account could reach from a known-clean system. Rotating secrets on the suspect laptop hands the new secrets to any shell still connected.

If a home directory is available, the loader creates ~/.ssh, sets that directory to mode 0700, and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys with mode 0600. The key comment is svc-telemetry. If that marker is already present, the loader records the fact and does not add a second copy. Whoever holds the matching private key can authenticate as that user without the account password, when SSH is reachable and public-key authentication is on. Modes 0700 and 0600 are conventional. A rule that fires only on loose permissions will pass a backdoor with correct permissions. Treat an unexplained svc-telemetry line as hostile.

SSH enablement was attempted on each platform and can stop at privileges. On macOS the loader checked Remote Login and tried a non-interactive systemsetup command to turn it on. On Linux it checked sshd or ssh through systemctl and tried several service-start commands. On Windows it used PowerShell to install OpenSSH Server, set automatic startup, and start sshd. Enabling Remote Login, installing OpenSSH Server, or starting a system service commonly requires elevated privileges. A host can show the authorized_keys line while the daemon never started. Failure of that step does not stop the rest of the chain.

The tunnel is an outbound session. The loader decoded an embedded OpenSSH private key into a temporary file, connected as the user tunnel to an attacker server, and requested remote forwarding to local port 22. It disabled host-key verification, ignored known_hosts, used only the embedded identity, and reconnected after 60 seconds. Unix-like branches preferred autossh and otherwise used ssh. Remote forwarding exposes the laptop’s port 22 through a connection the laptop starts. That path can cross NAT when outbound SSH is allowed. A scan that only looks for a new listening port on the laptop can miss the session.

The macOS file ~/.config/.smt is written to reconstruct the private key and keep launching the tunnel, next to ~/.config/.smtk. The LaunchAgent com.apple.sysmond.plist is marked RunAtLoad and KeepAlive, then loaded with launchctl. On Linux the same ~/.config files sit beside an @reboot crontab line. Killing one ssh or autossh process leaves those autostart entries in place. Copy network indicators, the key fingerprint, file paths, persistence names, and SHA-256 hashes from the OpenSourceMalware report into the ticket. This article does not repeat command-and-control addresses or file hashes.

What can a security lead verify on each operating system?

Verify three layers on each machine that may have loaded the build: the extension version, authorized_keys, and the autostart mechanism named for that OS. Record the version from the IDE and from the extensions directory before you delete files. Preserve the extension directory, a hash of extension.js, authorized_keys, process command lines, and the persistence files. Isolate the host while you copy. Remove the extension only after those copies exist.

macOS artifacts are a user LaunchAgent named com.apple.sysmond.plist with RunAtLoad and KeepAlive, plus ~/.config/.smt and ~/.config/.smtk. The plist name imitates a system monitor. It is not an Apple component. Linux uses the same ~/.config files and adds an @reboot crontab entry for the user. User crontabs sit outside the systemd units many endpoint rules watch. Windows writes .config\smt.cmd and a companion smtk file, then tries an on-start scheduled task named SysMon running as SYSTEM. If that task cannot be confirmed, it copies sysmon.cmd into the user’s Startup folder. A SYSTEM task is a wider finding than a per-user Startup item. Both the scheduled task and the Startup copy survive a marketplace uninstall. Removing Claude Code from the Cursor UI does not delete authorized_keys, the LaunchAgent, the crontab line, or those scripts.

OS	Autostart	Files to hash and keep
macOS	LaunchAgent com.apple.sysmond.plist, RunAtLoad and KeepAlive	~/.config/.smt, ~/.config/.smtk, extension.js
Linux	user crontab @reboot	same ~/.config/.smt and ~/.config/.smtk, extension.js
Windows	SysMon scheduled task as SYSTEM, or Startup folder	.config\smt.cmd, smtk, sysmon.cmd, extension.js

On Unix-like hosts, also look in the temp directory for a file whose name starts with .stk_. That is where the loader writes the decoded tunnel identity. The name is derived from the hostname and the home directory. On all three platforms, hunt Ed25519 lines in authorized_keys that your key inventory cannot explain, especially a line commented svc-telemetry. Hunt long-running ssh or autossh processes whose arguments request remote forwarding to local port 22. Put egress SSH in the detection query, not only new listeners on the laptop.

If the artifact loaded, disconnect the system and preserve forensic images before you delete the extension. Block the command-and-control address from the OpenSourceMalware indicators on ports 22 and 8099. Where you can show the loader ran, rebuild from a trusted image. No clean replacement version on the Cursor Marketplace is identified in the source. An operator session can leave changes the static loader never listed, and an SSH session that is already established can outlive extension removal. Then review logs for that developer identity across source control, cloud consoles, and SSO apps. An assumed breach assessment starts from that foothold and measures which repositories, cloud roles, and SSO applications the account could touch.

What is safe to tell the board, and what is still open?

One Cursor Marketplace build, anthropic.claude-code 2.1.313, was a trojanized extension. Cursor told OpenSourceMalware the marketplace experienced a compromise and that the origin was not Open-VSX. On a host that loaded the module, the intended impact is persistent remote access through an authorized SSH key and a reverse tunnel. Attacker identity, infection count, and any real use of the tunnel are unknown. The write-up does not date a victim window. The date you can cite is publication of the malicious version on 29 October 2026. Anthropic’s official Marketplace release and distribution infrastructure are not an established finding.

• In scope to check: machines that installed or loaded 2.1.313 from the Cursor Marketplace, on macOS, Linux, or Windows, wherever the extension ran with a user home directory.
• Called not malicious by the source: the @anthropic-ai/claude-code npm package, the OpenVSX extension, and the Microsoft VS Code Claude extension.
• Confirmed via the source’s update: a Cursor Marketplace compromise, with Open-VSX ruled out as the origin.
• Still open: publisher identity, publication method, whether any tunnel was used, how many hosts loaded the build, and any involvement of Anthropic’s own release process.

Pin IDE extensions by version and by a hash of extension.js, not by publisher display name. Turn off silent marketplace auto-update on laptops that hold production tokens. Keep CI cloud roles off interactive IDE logins. Add a check on extension entry points, because that is where this 66-line loader lived. Dean Hardcastle flagged the live publication to OpenSourceMalware.

FAQ

Was the Claude Code extension on the Cursor Marketplace compromised?

Yes, according to OpenSourceMalware and a statement Cursor gave that team. anthropic.claude-code 2.1.313 on the Cursor Marketplace was a trojanized build, and Cursor said the origin was not Open-VSX. The analysis does not establish that Anthropic's own release infrastructure was compromised.

Is Claude Code version 2.1.313 malicious?

The Cursor Marketplace copy of anthropic.claude-code 2.1.313 analyzed by OpenSourceMalware is malicious. A 66-line loader at the top of extension.js runs when the extension module loads and attempts an SSH backdoor. The source does not clear any other build of the same version number by version number alone.

Was the Claude Code NPM package backdoored?

OpenSourceMalware lists the @anthropic-ai/claude-code npm package, the OpenVSX extension, and the Microsoft VS Code Claude extension as not malicious. Scanning that npm tarball does not clear a separate Cursor Marketplace install of version 2.1.313.

Does the malicious Claude Code extension run without a chat?

Yes. The loader executes when the editor loads the extension module, not when a Claude conversation starts. Check the extension folder and the operating system artifacts, including the svc-telemetry key and the OS autostart names above.

If your IDE allowlist is a publisher name and a silent auto-update, agent::offense can test that path the way this loader did: extension entry points, SSH trust, and the cloud tokens sitting on the laptop. Start with an AI supply chain security audit scoped to developer tooling, then measure blast radius with an assumed breach assessment.