# Claude Code Extension Backdoored on Open VSX and Cursor

> A tampered Claude Code extension build planted an SSH backdoor via Open VSX and Cursor's marketplace, reaching up to 5,000 users. How to check.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-30
- Canonical (HTML): https://cellcog.ai/blog/claude-code-extension-backdoor/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- A build published as version 2.1.313 of Anthropic's Claude Code extension carried a backdoor. OpenSourceMalware found it on Open VSX; Cursor confirmed it in its own marketplace.
- Sixty-six lines run before the real extension, add an SSH key labelled svc-telemetry and open a reverse tunnel to an attacker's server.
- The editor still works normally, because almost every error in the injected code is suppressed.
- Version 2.1.313 is in no registry now. We checked Open VSX, the VS Code Marketplace and npm on October 30; all three go from 2.1.312 to 2.1.314.
- Cursor says the build was not developed by Anthropic, was live for about 11 hours on October 29, and reached at most 5,000 users.

## At a glance

- **What happened?** A build published as version 2.1.313 of the Claude Code extension, on Open VSX and in Cursor's marketplace, contained 66 lines that add an attacker's SSH key, open a reverse tunnel and install persistence. Cursor puts the reach at 5,000 users at most.
- **Is the bad version still out there?** No. Open VSX, the VS Code Marketplace and npm all go from 2.1.312 straight to 2.1.314, which was published across the three within about an hour on October 30.
- **Was Anthropic's official release compromised?** Cursor says the malicious version was not developed by Anthropic and that it has no evidence other versions or the official distribution are affected. Anthropic has not commented.

A build of Anthropic's Claude Code extension published to the Open VSX registry as version 2.1.313 carried a backdoor that added an attacker's SSH key to the user's machine and opened a reverse tunnel to a server the attacker controls. The analysis was published by [OpenSourceMalware](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) on October 30, 2026, and the first widely seen warning went up on X at [03:33 UTC](https://x.com/adnanthekhan/status/2116010483702706337).

Cursor then confirmed the same version had been in its own extension marketplace. In a [security notice](https://cursor.com/blog/claude-code-extension-security-notice) and an [X post](https://x.com/cursor_ai/status/2116074289053175808), it says the build was live from 2:27am to 1:35pm Pacific on October 29 and that "At most 5,000 users were affected, and we will reach out directly." Anthropic has published no statement.

## What Cursor confirmed

Cursor's notice is the first account from a company that actually distributed the build. It says plainly: "This malicious version of the extension was not developed by Anthropic." It removed the version, then shut its whole extension marketplace down, audited it, rotated its keys, rebuilt it and brought it back. It also worked with the hosting provider to take the attacker's server offline, and writes that "The attacker server no longer functions."

What Cursor's notice adds to the researchers' report:

- **Who built it:** not Anthropic, Cursor says.
- **Where:** Cursor's VS Code extension marketplace, as well as Open VSX.
- **When:** 2:27am to 1:35pm Pacific, October 29, 2026.
- **How many:** at most 5,000 users, whom Cursor will contact directly.
- **Attacker server:** taken offline with the hosting provider.

The SSH detail matters more than it looks. Because enabling the local SSH service needs administrator rights, Cursor says the step failed on most macOS and Windows machines, so the attacker could not log in through the tunnel. The extension still added the attacker's key, installed its persistence and sent host details out, which is why Cursor asks every affected user to run its remediation anyway.

## What the loader did

The package looked normal. The bundled binary was the official one and the interface was unchanged. The only altered file was `extension.js`, where 66 lines of new code sat in front of the real extension and ran first, which means a user never had to start a Claude conversation for it to fire.

![Animation: a play marker crosses a short amber block at the start of a long teal bar, dropping three amber arrows to boxes reading SSH key added, Tunnel opened and Beacon sent, then continues along the teal part to a check mark reading Editor loads normally.](https://cellcog.ai/blog/media/claude-code-extension-backdoor/load.svg)
*The 66 injected lines run before the real extension, so the editor still works.*

*Table: What the loader did, by the OpenSourceMalware analysis*

| Step | Behaviour | Status in the report |
|---|---|---|
| Runs | 66 prepended lines execute before the real extension loads | Confirmed |
| Collects | Hostname, user, OS, git email, names of up to 40 variables holding KEY, TOKEN, SECRET, PASS, AWS or GCP | Confirmed |
| Opens a door | Appends an Ed25519 key labelled svc-telemetry to the user's authorized_keys | Confirmed |
| Turns on SSH | Tries to enable Remote Login on macOS, sshd on Linux, OpenSSH Server on Windows | Depends on privileges |
| Phones home | Reverse SSH tunnel to 134.209.82.225, plus a plain HTTP beacon on port 8099 | Confirmed |
| Stays | LaunchAgent named com.apple.sysmond, a cron reboot entry, or a scheduled task named SysMon | Depends on platform |

Two details make this worse than the usual package-manager attack. Errors are suppressed almost everywhere, so when a step fails the real extension keeps loading and nothing looks wrong. And the persistence names borrow from system monitoring, so a quick look at a process list or a LaunchAgents folder does not obviously show an intruder.

## Where version 2.1.313 is now

We checked the three places the extension ships from: the [Open VSX version list](https://open-vsx.org/api/Anthropic/claude-code/versions), the [VS Code Marketplace listing](https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code) and the [npm package](https://registry.npmjs.org/@anthropic-ai/claude-code). The malicious version is in none of them, and the clean follow-up went out across all three within about an hour.

![Animation: three lanes labelled Open VSX, VS Code Marketplace and npm, each with a filled teal 2.1.312 slot, an empty dashed amber 2.1.313 slot marked In no registry, and a teal 2.1.314 slot that fills in with its time.](https://cellcog.ai/blog/media/claude-code-extension-backdoor/registries.svg)
*Version 2.1.313 is in no registry; 2.1.314 went out to all three within an hour.*

*Table: Published versions of the Claude Code extension, checked October 30, 2026 at 06:45 UTC*

| Where | 2.1.312 | 2.1.313 | 2.1.314 |
|---|---|---|---|
| Open VSX | Oct 27, 20:26 UTC | Not in the registry | Oct 30, 01:07 UTC |
| VS Code Marketplace | Listed | Not listed | Oct 30, 01:17 UTC |
| npm, @anthropic-ai/claude-code | Oct 27, 18:36 UTC | No publish time recorded | Oct 30, 00:12 UTC |

A missing version number alone was never proof of a takedown, which is why we held back on it before Cursor spoke. Cursor's notice now settles part of it: the 2.1.313 build in its marketplace was not Anthropic's, and Cursor removed it. The Open VSX listing's download counter is an all-time figure for the extension, not a count of people who got the bad build; Cursor's 5,000 is the only reach figure anyone has given.

## What is not established

The researchers draw the line themselves. Their report says the findings "show that this specific artifact is malicious; they do not, by themselves, demonstrate that Anthropic's official Marketplace release or distribution infrastructure was compromised." They also say they do not know how the build got published, only that the Open VSX publishing account belongs to an Anthropic employee, and that the employee may or may not have been compromised.

Cursor's notice answers some of that and leaves the rest open. Still unknown: how the build got published, whether Open VSX and Cursor received it through the same account, how many of Cursor's at most 5,000 users actually ran it, and what Anthropic's own investigation finds. Cursor says it has "no evidence that other versions of the extension or the official distribution are affected." We have found no statement from Anthropic, Open VSX or the Eclipse Foundation.

## If you installed it

The report's own advice is blunt: "Rebuilding the host is safer than assuming removal of known artifacts restores trust." If you installed or updated the Claude Code extension in Cursor between 2:27am and 1:35pm Pacific on October 29, or pulled it from Open VSX in the last few days on VSCodium, Windsurf or another editor, check before you assume you are clean, and move to 2.1.314. Cursor adds that "Uninstalling the extension may not be sufficient" because the payload leaves its own scripts running.

Cursor's one-line check on macOS is `grep -qs svc-telemetry ~/.ssh/authorized_keys && echo found`, and it publishes remediation scripts for macOS and Windows in the notice. Look for the SSH key comment `svc-telemetry` in `~/.ssh/authorized_keys`, for `~/.config/.smt` and `~/.config/.smtk`, for a LaunchAgent at `~/Library/LaunchAgents/com.apple.sysmond.plist` on macOS, a cron entry that runs at reboot on Linux, or a scheduled task named SysMon on Windows. On the network side, block and search for 134.209.82.225 on ports 22 and 8099. If any of it is present, treat the credentials that machine could reach as exposed and rotate them from a different computer.

## Why this one matters beyond one extension

The interesting part is not the malware, which is ordinary. It is the delivery. Coding agents arrive as editor extensions that people install in seconds and update silently, and those extensions run with the full rights of the developer who installed them: their SSH keys, their cloud credentials, their repositories. An agent extension is one of the highest-privilege things on a working machine, and it is distributed through the lowest-friction channel we have.

That is the same structural problem behind the [LiteLLM package that shipped malware](https://cellcog.ai/blog/litellm-1-107-0-malware/) and behind [agents breaking out of a sandbox at OpenAI](https://cellcog.ai/blog/openai-hugging-face-incident/). The answer is not to stop using agents. It is to stop giving them your own identity. An agent with its own account, its own machine and an explicit list of what it may reach is recoverable when something like this happens; an agent wearing your login is not.

## FAQ

**What is Open VSX?**

An open registry of editor extensions run by the Eclipse Foundation. Editors that cannot use Microsoft's Marketplace, including Cursor, VSCodium and Windsurf, pull extensions from it.

**How do I know if I was hit?**

Look for an SSH key commented svc-telemetry in authorized_keys, for the files .smt and .smtk under your config folder, for a LaunchAgent named com.apple.sysmond, a reboot cron entry or a scheduled task named SysMon.

**Is removing the extension enough?**

The researchers say no. The implant opens an interactive route into the machine, so they recommend rebuilding the host and rotating credentials from a clean computer.

**Has Anthropic said anything?**

Not that we could find. Cursor published a security notice on October 29; we found no statement from Anthropic, Open VSX or the Eclipse Foundation.

**What is the wider lesson?**

Agent extensions run with all the rights of the developer who installed them. Giving an agent its own account and its own machine is what makes an incident like this recoverable.

## Related

- [LiteLLM 1.107.0 Malware: What Happened and What to Do](https://cellcog.ai/blog/litellm-1-107-0-malware/index.md)
- [OpenAI Hugging Face Incident: What Happened and Changed](https://cellcog.ai/blog/openai-hugging-face-incident/index.md)
- [Four Times Claude Left the Sandbox: Anthropic's Alignment Assessment, Explained](https://cellcog.ai/blog/claude-cybersecurity-incidents/index.md)
- [AI Employee Security Checklist for a Production Pilot](https://cellcog.ai/blog/ai-employee-security-checklist/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/claude-code-extension-backdoor/. Try CellCog free, no credit card needed: https://cellcog.ai/signup