Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Source AlienVault OTX General
Description
A compromised version of the Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was distributed through the Cursor extension marketplace from October 29, 2026, between 2:27 AM and 1:35 PM PDT. The malicious extension contained injected JavaScript that executed during module loading to establish persistent backdoor access. The loader collected host reconnaissance data, installed an attacker-controlled SSH key, enabled local SSH services, established reverse SSH tunneling to infrastructure at 134.209.82.225, and configured platform-specific persistence mechanisms including macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks. The attack leveraged built-in system tools to avoid detection while maintaining access. Microsoft confirmed the malicious packages were never distributed through Visual Studio Marketplace or npm, and Anthropic's systems were not compromised. The incident appears limited to Cursor marketplace.