Cursor Claude Code extension backdoor: check now

What happened

Cursor is an AI code editor built on VS Code. It gets third-party extensions from the Open VSX registry, but serves them through its own proxy, marketplace.cursorapi.com (Cursor docs). OpenSourceMalware describes this as an internal service that mirrors Open VSX and also hosts Cursor’s own extensions (OpenSourceMalware).

29 October 2026, about 02:27 to 13:35 PT: Cursor’s marketplace served modified builds of Anthropic.claude-code 2.1.312 and 2.1.313 for macOS (darwin-arm64) and Windows (win32-x64). Cursor says these versions “were not developed by Anthropic” (Cursor).
29 October: Cursor removed the versions, shut the whole marketplace down, audited access, rotated keys, rebuilt it and brought it back. It worked with the hosting provider to take the attacker’s server offline and found no other tampered extensions (Cursor).
30 October, 11:30 PT: Cursor updated its notice to add 2.1.312 and revise the indicators (Cursor).

Phorion and OpenSourceMalware analysed the samples (BleepingComputer). The official Claude Code extension on Open VSX and the VS Code Marketplace, and the @anthropic-ai/claude-code npm package, were not affected (OpenSourceMalware).

How it got onto the marketplace: not disclosed. Neither Cursor nor Anthropic has explained how a package under Anthropic’s name was published. No attacker has been named. BleepingComputer cites up to 5,000 exposed developers without a source; Cursor has not given an install count (BleepingComputer).

What the payload does. A 66-line loader was prepended to extension.js, so it runs as soon as Cursor loads the extension, with no Claude conversation needed (OpenSourceMalware). Per Cursor’s notice:

Sends hostname, username, OS, home directory, working directories, Git email, public IP and the names of environment variables to 134.209.82.225:8099/beacon. Phorion says it picks names matching KEY|TOKEN|SECRET|PASS|AWS|GCP, not their values (Phorion).
Appends an attacker ed25519 key with the comment svc-telemetry to ~/.ssh/authorized_keys.
Tries to turn on the local SSH server and open a reverse tunnel, ssh -N -R '*:0:localhost:22' tunnel@134.209.82.225.
Persists through a LaunchAgent (com.apple.sysmond) on macOS, or a SysMon scheduled task with a Startup-folder fallback on Windows, retrying the tunnel about every 60 seconds.

Bugs probably stopped the inbound access path on many machines: on macOS the Remote Login check fails without admin rights, and on Windows the OpenSSH setup is invoked through /bin/sh, which standard Windows lacks. The key and the persistence were still installed (BleepingComputer). Phorion also reports a Linux cron bug that can wipe a user’s existing cron jobs (Phorion).

Other malicious extensions on Open VSX in 2026

Cursor installs third-party extensions from Open VSX, so these could reach Cursor users too:

30 January, oorzc account hijack (GlassWorm). A legitimate publisher’s credentials were used to push malicious oorzc.ssh-tools 0.5.1, oorzc.i18n-tools-plus 1.6.8, oorzc.mind-map 1.0.61 and oorzc.scss-to-css-compile 1.3.4, which had more than 22,000 prior downloads. The GlassWorm loader stole browser logins, crypto wallets, macOS Keychain data, ~/.aws, ~/.ssh, and npm and GitHub tokens (The Hacker News; Socket).
31 January to 13 March, 72 transitive extensions (GlassWorm). Benign-looking extensions gained extensionPack or extensionDependencies entries in later updates that pulled in a GlassWorm extension. Examples: otoboss.autoimport-extension, twilkbilk.color-highlight-css, crotoapp.vscode-xml-extension, and daeumer-web.es-linter-for-vs-code, a typosquat of the real ESLint publisher (Socket).
25 to 29 April, 73 sleeper clones. Impersonation extensions published clean and activated later; on 29 April, 17 new versions pulled in blockstoks.easily-gitignore-manage through extensionPack. The payload installs further .vsix files with --install-extension into VS Code, Cursor, Windsurf and VSCodium (Socket). Socket keeps the full list on its GlassWorm tracking page.
18 May, Nx Console 18.95.0. Published to Open VSX and the VS Code Marketplace with stolen access; covered in our TanStack and Nx Console advisory.

Am I affected?

Only Cursor’s marketplace served the bad builds, and only for macOS and Windows. Cursor’s own test is the key check (Cursor):

bash

# macOS and Linux
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

powershell

# Windows PowerShell
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Then look for the other indicators Cursor lists (Cursor):

bash

# macOS persistence and dropped files
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null
ls -la "$TMPDIR"/.stk_* 2>/dev/null
# Tunnel processes
pgrep -fl "134.209.82.225|localhost:22|autossh"
# Any copy of the bad extension versions still on disk
find ~ -maxdepth 4 -type d -iname 'anthropic.claude-code-2.1.31[23]*' 2>/dev/null

On Windows, check for %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_*, a scheduled task named SysMon (schtasks /query /tn SysMon) and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd. On the network side, search for connections to 134.209.82.225 on ports 22 and 8099. The extension.js SHA-256 is ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15; Cursor also lists hashes for each VSIX (Cursor).

For the GlassWorm waves, open the Extensions panel (Cmd or Ctrl+Shift+X) in Cursor and in any other editor that installs from Open VSX, and compare what is installed with the IDs above and Socket’s tracking page. Removed extensions stay installed in editors until you uninstall them (The Hacker News).

What to do now

If the key is present, isolate the machine and treat it as compromised (Cursor).
Remove the backdoor. Cursor publishes remediate-macos.sh (run as the affected user, not root) and remediate-windows.ps1 (run as Administrator) from its notice. Both remove the extension, the persistence, tunnel processes and the attacker key, and exit non-zero if anything remains. Cursor says a rebuild may be warranted (Cursor).
Rotate from a clean machine every credential and session reachable from the affected host (Cursor). The beacon sent the names of your secret-bearing environment variables, so start with those: they tell the attacker exactly what to look for.
Turn off Remote Login or the OpenSSH server if you do not use it, and check ~/.ssh/authorized_keys on other machines you reach with the same SSH keys.
Slow down extension updates. Cursor team admins can set a Marketplace Install Cooldown in team settings, and individuals can set extensions.installCooldownHours (Cursor docs). The bad builds were live for about 11 hours, so a cooldown longer than that would have given Cursor time to pull them before your editor took them.

Trojanized Claude Code extension on Cursor’s marketplace planted an SSH backdoor (2.1.312, 2.1.313), plus 2026’s other malicious Open VSX extensions