Supply chain security remains a critical vulnerability in the AI developer tooling ecosystem. On October 29, 2026, researchers at OpenSourceMalware identified a malicious variant of the Claude Code extension distributed via the Cursor Marketplace. The compromised package, identified as anthropic.claude-code version 2.1.313, contains a 66-line JavaScript loader prepended to the legitimate extension bundle. This implant executes immediately upon VS Code startup, establishing a persistent SSH backdoor without requiring user interaction beyond loading the module. Cursor has since confirmed the compromise originated within their marketplace infrastructure, distinguishing it from the official NPM package or Open-VSX distributions.

Anatomy of the Implant

The malicious code operates as an Immediately Invoked Function Expression (IIFE) that imports Node.js core modules for process, filesystem, and cryptographic operations. Unlike traditional malware that relies on package-manager lifecycle hooks, this variant triggers at extension runtime. The loader collects immediate reconnaissance data, including hostname, local username, OS architecture, and names of environment variables containing keywords like KEY, TOKEN, SECRET, AWS, or GCP. It then appends an Ed25519 key labeled 'svc-telemetry' to the user’s ~/.ssh/authorized_keys file, granting the attacker persistent remote access. The implementation suppresses exceptions to ensure the legitimate extension continues to function, masking the compromise from the user.

Network Behavior and Persistence

The implant establishes a reverse SSH tunnel to the command-and-control (C2) server at 134.209.82.225. It decodes an embedded base64 private key to authenticate the connection, forwarding victim port 22 to a dynamic remote port using the flag -N -R '*:0:localhost:22'. Persistence is achieved through platform-specific mechanisms: macOS users receive a deceptive LaunchAgent named com.apple.sysmond, Linux systems get a cron @reboot entry, and Windows hosts encounter a scheduled task or Startup folder item. Additionally, the malware sends unencrypted HTTP beacons to port 8099, exfiltrating collected JSON data and querying public IP addresses via ifconfig.me and api.ipify.org.

Scope and Remediation

It is crucial to note that this compromise is specific to the Cursor Marketplace distribution channel. The official @anthropic-ai/claude-code NPM package, the Open-VSX extension, and the standard Microsoft VS Code extension remain unaffected. The malicious artifact does not download secondary payloads; its functionality is entirely contained within the injected loader and embedded scripts. Security teams should immediately inspect affected endpoints for the presence of the 'svc-telemetry' SSH key, the .smt configuration files, and active ssh or autossh processes. Given the interactive nature of the backdoor, credential rotation from a known-clean system and potential host rebuilding are recommended over simple artifact removal.

Key Takeaways

  • The malicious code is specific to the Cursor Marketplace version 2.1.313; the official NPM, Open-VSX, and Microsoft VS Code extensions are not affected.
  • The implant establishes a persistent reverse SSH tunnel to 134.209.82.225 and exfiltrates host reconnaissance data via unencrypted HTTP beacons.
  • Remediation requires more than removing the extension; it involves rotating credentials and potentially rebuilding the host due to the interactive SSH access.

The Bottom Line

This incident proves that developer trust is a fragile asset; a single compromised marketplace artifact can silently bypass traditional sandbox expectations, forcing teams to treat every extension load as a potential root-level compromise.