# Claude Code extension supply chain attack

> Developing situation record from CLSTR: https://clstr.news/situations/claude-code-extension-supply-chain-attack
> Updated: 2026-10-30T12:12:55.000Z. Sources: 17. Developments: 2.

A malicious version of the Claude Code VS Code extension, specifically version 2.1.313, was identified as part of a supply chain attack. The trojanized version contained a 66-line loader that executed automatically to collect system information, including hostnames, usernames, OS architecture, and Git email addresses. It also inventoried up to 40 environment variable names related to sensitive credentials like AWS and GCP.

To establish persistent access, the malware appended an SSH public key labeled “svc-telemetry” to the user’s authorized_keys file and attempted to establish reverse SSH tunnels to the IP address 134.209.82.225. On macOS, the malware attempted to maintain persistence by disguising itself as a LaunchAgent named “com.apple.sysmond”.

Reports indicate the malicious package was available on the Open VSX registry via an account associated with an Anthropic employee. Additionally, the compromise affected the Cursor AI coding editor marketplace, where the tampered extension was available for approximately 11 hours on October 29. Cursor reported that at most 5,000 users were affected. While flaws in the malware prevented successful SSH tunneling on many systems without administrator privileges, it could still collect data and install unauthorized SSH keys.

Cursor has since removed the package, temporarily shut down its marketplace, and rotated keys. Anthropic clarified that its official distribution channels and systems were not breached, and the incident was limited to users who downloaded the specific version through the affected marketplaces. The legitimate Claude Code extension has since been updated to version 2.1.314.

## Claims

- A malicious version of the Claude Code extension (2.1.313) was available on the Cursor marketplace for approximately 11 hours on October 29. (reported by 11 sources)
- The malicious extension attempted to install an SSH backdoor on Windows, macOS, and Linux systems. (reported by 10 sources)
- The SSH backdoor attempt often failed on Windows and macOS because it lacked administrator privileges. (reported by 8 sources)
- The malware collected system information including usernames, hostnames, public IP addresses, and Git email addresses. (reported by 7 sources)
- Anthropic stated that its own systems and employee laptops were not compromised during the incident. (reported by 5 sources)
- The malicious extension was published using the official Anthropic account on the Cursor marketplace. (reported by 3 sources)
- Cursor responded by taking its marketplace offline, rotating keys, and rebuilding the marketplace. (reported by 2 sources)

## Timeline

### 2026-10-30: Cursor marketplace compromise affects up to 5,000 developers

A tampered Claude Code extension was available on the Cursor marketplace for 11 hours, potentially affecting 5,000 developers with an SSH backdoor before being removed.

13 sources. https://clstr.news/cluster/cursor-marketplace-compromise-affects-up-to-5000-users

### 2026-10-30: Claude Code extension found with SSH backdoor on Open VSX

A trojanized Claude Code VS Code extension (v2.1.313) on Open VSX was found to plant an SSH backdoor and harvest system information via a malicious loader.

4 sources. https://clstr.news/cluster/claude-code-extension-found-with-ssh-backdoor-on-open-vsx

---
Cite as: Claude Code extension supply chain attack. CLSTR, https://clstr.news/situations/claude-code-extension-supply-chain-attack