On October 29, 2026, a tampered copy of the Claude Code extension appeared in the Cursor VS Code Extension Marketplace [[S1], [S2]]. Cursor reported that versions 2.1.312 and 2.1.313, listed as Anthropic.claude-code, were available for a short window, live from about 2:27 AM to 1:35 PM Pacific Daylight Time [[S1], [S2]].
Cursor and Microsoft said Anthropic did not develop the malicious versions [[S1], [S2]]. Anthropic told Microsoft its systems were untouched and it had no role in publishing the package (Microsoft Security Blog). Microsoft Threat Intelligence added that official channels such as the Microsoft Visual Studio Marketplace and the npm package @antropic-ai/claude-code remained clean.
Analysis of the injected JavaScript showed the loader ran before the extension initialized. The script leveraged Node.js APIs to enumerate host details—hostname, username, operating system, architecture, home directory, environment variable names, working directories, configured Git email, and public IP [[S1], [S2]]. After gathering this data, the loader tried to drop an attacker‑controlled SSH key and enable the local SSH service [[S1], [S2]].
The code then attempted to open a reverse SSH tunnel and set up persistence on multiple platforms [[S1], [S2]]. On macOS it created a LaunchAgent; on Windows it scheduled a task to run as SYSTEM with a fallback Startup script (Cursor). Background scripts were programmed to retry the tunnel roughly every 60 seconds.
Remote access required sufficient host privileges and specific configurations. Cursor noted that, except in rare cases where the application runs with administrator rights, errors in the malicious code would usually cause the tunnel setup to fail. Microsoft observed that even when the tunnel failed, the loader could still write SSH keys and persistence artifacts.
To mitigate the threat, Cursor worked with the hosting cloud provider to shut down the attacker’s server. Affected organizations should locate compromised systems, preserve evidence, remove malicious files, review telemetry, and rotate credentials or revoke sessions if exposure is suspected. Security teams also need to verify endpoint and network signals to confirm no lingering unauthorized access.
This supply-chain incident highlights the inherent risks third-party extension marketplaces face when unverified or tampered packages bypass ingestion controls. The rapid intervention by Cursor and the cloud provider blunted the attack's effectiveness, particularly given code errors that limited execution success without administrative privileges. However, the reliance on automated updates suggests that developers and security teams must maintain heightened vigilance regarding extension integrity in AI-assisted development environments.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation