A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was distributed via the Cursor extension marketplace on October 29, 2026. This compromised extension injected JavaScript that executed during module loading to establish a persistent SSH backdoor. It collected host reconnaissance data, installed an attacker-controlled SSH key, enabled local SSH services, and created reverse SSH tunnels to attacker infrastructure. Persistence was maintained through platform-specific mechanisms such as macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks. The attack used built-in system tools to evade detection. Microsoft confirmed the malicious packages were not distributed through Visual Studio Marketplace or npm, and Anthropic's systems were not compromised. The incident appears limited to the Cursor marketplace.