The Fake Claude Code Extension: How 11 Hours in a Marketplace Became an SSH Backdoor

On October 29, 2026, someone shipped tampered builds of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, to Cursor's VS Code extension marketplace. The builds were served under the extension's legitimate publisher ID, anthropic.claude-code, and stayed live from about 2:27am PT to 1:35pm PT, roughly eleven hours. Cursor estimates that at most 5,000 users may have installed them.

The builds were not developed by Anthropic. Anthropic has confirmed its own systems were not compromised. The attack targeted the distribution channel, not the vendor.

What actually happened

The timeline, as reported by Cursor's security notice and independent researchers:

• 2:27am PT, Oct 29: Tampered builds go live in Cursor's marketplace under the real extension ID.
• 1:35pm PT, Oct 29: Cursor removes them, about eleven hours later.
• Oct 30: Cursor publishes its security notice, works with the hosting provider to take the attacker's server offline, temporarily shuts down its entire extension marketplace to audit and rebuild it, and rotates internal keys.
• Oct 30: Anthropic ships the clean build 2.1.314, deliberately skipping the poisoned version numbers "in order to disambiguate" them.

Microsoft's official VS Code Marketplace and Open VSX were not affected. Only Cursor's marketplace served the tampered builds.

What the backdoor did

Security researchers tore the malicious builds apart. The anatomy is worth understanding, because it is a textbook supply-chain attack:

• It hijacked the startup. A 66-line loader was prepended to the extension's main JavaScript bundle. It ran the moment the editor started, before the extension's activate() function was even called. No chat had to be opened. No prompt had to be typed.
• It planted an SSH key. An attacker-controlled public key, labeled "svc-telemetry", was appended to the user's ~/.ssh/authorized_keys file. That is a standing invitation for remote access.
• It made itself persist. On macOS it registered a LaunchAgent named to look like an Apple component. On Windows it created a scheduled task called SysMon. On Linux it added a cron entry that runs at reboot. The reverse SSH tunnel retried roughly every sixty seconds.
• It phoned home. Hostname, username, operating system, home directory, configured Git email address, public IP address, and the names of environment variables that looked like passwords or tokens were sent to a server run by the attackers.

The detail that should unsettle every developer: it used the real extension ID. Publisher IDs are the trust signal we all teach each other to check. This attack wore it like a uniform.

Why updating is not enough

This is the part most people will miss, and it is the most important paragraph in this article.

The clean update, version 2.1.314, does not remove the backdoor. Uninstalling the extension does not remove it either. Cursor's own notice says uninstalling "may not be sufficient". The SSH key, the persistence entries, and any running tunnels live outside the extension's install directory, so they survive everything the marketplace can do to you.

Cleanup is manual. Cursor has published cleanup scripts, and the indicators of compromise are documented, but every affected machine needs a human to run the check.

Your 5-minute check

If you use Cursor, run this today:

• Check. Open Cursor's extensions panel and look for anthropic.claude-code versions 2.1.312 or 2.1.313. If you were on the official VS Code Marketplace or Open VSX, you were not affected.
• Remove. Search ~/.ssh/authorized_keys for "svc-telemetry" and delete the entry. Remove the LaunchAgent, scheduled task, or cron entry. Run Cursor's published cleanup script to catch running tunnels.
• Secure. Install the clean 2.1.314 from an official store. Rotate any secrets that lived on the machine. Consider setting an extension install cooldown so a future malicious update sits for a few days before it auto-installs.

What teams should learn

At DesignsToDeploy, four habits come out of incidents like this:

• Verify publisher IDs, but never treat them as a guarantee. They are a signal, not a proof.
• Audit sensitive files on a schedule, not after an incident. ~/.ssh/authorized_keys is a five-minute cron job away from being monitored.
• Delay automatic updates for critical tooling. A cooldown of a few days lets the rest of the world find the poison first.
• Treat every dependency as part of your attack surface. Your editor's extensions, your npm packages, your CI plugins. If it runs code on your machine, it is in scope.

Supply-chain security is not a product you buy. It is a habit you build, one checklist at a time.

If you are building software and want security baked in from day one instead of patched in a panic, we can help: designstodeploy.dev

1 / 5