What changed and news
A modified and malicious version of Anthropic’s official Claude Code extension was distributed through the Cursor editor’s extension marketplace for approximately 11 hours in October 2026. Identified under version number 2.1.313, the malicious payload was active between 2:27 a.m. and 1:35 p.m. Pacific Time, exposing up to 5,000 developers to a package designed to deploy persistent SSH backdoors. The Cursor editor, built on top of Microsoft’s open-source Visual Studio Code, supports native platform extensions, which facilitated the distribution of the compromised package.
Security analyses indicate that threat actors inserted a malicious JavaScript loader at the very beginning of the extension.js file while leaving the legitimate extension code intact. Consequently, the malicious routine executed automatically upon extension load, requiring no direct user interaction with the AI assistant. The script gathered detailed system data, Git configuration credentials, and the public IP address of the compromised machine, transmitting this information to an external server.
Practical impact for developers
For software engineers and system administrators relying on integrated development environments, the incident underscores deep supply chain risks inherent in third-party extension marketplaces. Although the initial script did not directly harvest passwords, the malware attempted to configure attacker-controlled SSH keys and establish persistent reverse tunnels using local mechanisms such as macOS LaunchAgents or Windows scheduled tasks.
In practice, the reconnaissance data transmitted to the attackers’ servers provided a comprehensive map of the development environment. This included environment variables tied to sensitive credentials, enabling malicious operators to plan targeted secondary incursions should the initial remote access succeed.
Limitations and what to evaluate
Despite the malicious payload’s destructive intent, coding errors within the SSH configuration routines ultimately restricted the attackers’ remote access success across many Windows and macOS systems. On macOS, attempts to verify whether remote login was enabled executed the systemsetup command without elevated privileges, producing a permission error that caused the script to skip activation entirely. On Windows, the malware attempted to invoke the OpenSSH server via /bin/sh, a Unix shell absent from standard operating system installations.
These mistakes prevented the reverse tunnel from functioning properly on machines where the SSH service was not already running. Nevertheless, persistence mechanisms and metadata collection still operated, demanding strict infrastructure audits on any workstation that downloaded the package during the exposure window.
What to expect next
As an immediate response to the incident, Cursor maintainers removed the compromised package, temporarily shut down the entire marketplace for auditing, and rotated access keys. Furthermore, collaboration with hosting providers enabled the takedown of the attacker-controlled server, disrupting telemetry and tunnel traffic.
Impacted developers must inspect their local environments for unauthorized SSH keys—such as the ‘svc-telemetry’ key—and follow strict remediation guidelines, including host isolation, session invalidation, and rebuilding environments from secure backups.