Anthropic Claude Code extension compromised via Cursor Marketplace

A trojanized version of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) was distributed through the Cursor Marketplace and Open VSX on October 29, 2026. The malicious builds were available for approximately 11 hours under a compromised legitimate publisher identity.

The malicious extension functions by inserting an attacker-controlled SSH key into the host machine and establishing a reverse SSH tunnel to enable remote access. It targets macOS on Apple Silicon and Linux systems. Notably, the attack includes uninstallation-resistant persistence, as the malicious startup scripts remain on the operating system even after the extension is removed from the editor.

Anthropic has disavowed the malicious builds, confirming they were not developed by the company. Because no CVE was assigned to these specific versions, traditional CVE-driven scanners may fail to detect them. Up to 5,000 developers using Cursor or VS Code-compatible editors are potentially at risk of credential theft, lateral movement, and environment compromise.