Threat reportSupply ChainTL-2026-4820
Malicious Anthropic.claude-code extension version 2.1.313 distributed via Cursor Extension Marketplace (SSH backdoor and persistence on macOS and Windows)
Malicious Anthropic.claude-code extension version 2.1.313 (TL-2026-4820) is a high-severity supply-chain compromise, first published 2026-10-30 and last reviewed 2026-10-31. It has no confirmed attribution, affects Cursor Cursor Extension Marketplace - Anthropic.claude-code extension, maps to 21 MITRE ATT&CK techniques (T1016, T1021.004, T1033), and is covered by 9 detection rules and 42 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 42Indicators of compromise
Key facts for TL-2026-4820
- Threat ID
- TL-2026-4820
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 42
- Updates
- 2026-10-31 · 4 updates · revalidated 4× · latest source
How Malicious Anthropic.claude-code extension version 2.1.313 works
Cursor reported that a malicious version (2.1.313) of the Anthropic.claude-code extension was available on the Cursor extension marketplace for macOS (darwin-arm64) and Windows (win32-x64) on 2026-10-29 from 2:27 AM PT until it was removed at 1:35 PM PT. The package collected host and user data, tried to add an attacker SSH key and enable SSH with a reverse tunnel, installed persistence, and reported to 134.209.82.225; at most 5,000 users were affected.
On 2026-10-29 at 2:27 AM PT a malicious build of the Anthropic.claude-code extension, version 2.1.313, became available through the Cursor VS Code extension marketplace. Cursor detected the incident and removed it at 1:35 PM PT the same day (about 11 hours). Only the darwin-arm64 (macOS Apple silicon) and win32-x64 (Windows) packages were malicious. Cursor states that at most 5,000 users were affected. The vendor notice does not describe how the malicious version reached the marketplace, and no CVE, CVSS score or threat-actor attribution has been published.
Per Cursor's notice the extension performs four actions in sequence. (1) It collects system data: hostname, username, OS type, architecture, home directory, environment variable names, working directories, Git email and public IP address. (2) It attempts to append an attacker ed25519 SSH public key (comment 'svc-telemetry') to authorized_keys, enable the SSH service (systemsetup -setremotelogin on on macOS; Add-WindowsCapability OpenSSH.Server on Windows) and establish a reverse tunnel (ssh -N -R '*:0:localhost:22', or autossh -M 0, with StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30 and ServerAliveCountMax=3) to tunnel@134.209.82.225:22. This step fails on most systems because it requires administrator privileges. (3) It installs persistence that retries the tunnel roughly every 60 seconds: a LaunchAgent (~/Library/LaunchAgents/com.apple.sysmond.plist, label com.apple.sysmond) on macOS, and a scheduled task named 'SysMon' (which attempts to run as SYSTEM) plus a Startup-folder script sysmon.cmd on Windows. Helper files include ~/.config/.smt, ~/.config/.smtk (smt.cmd and smtk on Windows) and a temp file named .stk_<10 hex>. (4) It posts host details and backdoor status over HTTP to the /beacon endpoint on port 8099 of 134.209.82.225; a loopback beacon (127.0.0.1:8099/beacon) is also listed as an indicator.
Response: Cursor removed the malicious version, blocked further distribution, temporarily shut down the marketplace, audited access and confirmed no other extensions were compromised, rotated cryptographic keys, rebuilt marketplace infrastructure and coordinated with the hosting provider to take the attacker server offline. The hunt record states the vendor assessed the attacker server as no longer functioning and most privilege-escalation attempts as failed, so the incident is treated as contained. Hosts that installed 2.1.313 may nevertheless retain persistence artifacts and an authorized SSH key; Cursor warns that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts. Cursor provides a one-line check for the svc-telemetry key in authorized_keys (and C:\ProgramData\ssh\administrators_authorized_keys on Windows) and remediation scripts remediate-macos.sh (run as the affected user, not root) and remediate-windows.ps1 (run as Administrator). The notice says environment variable names, not values, were collected; credentials in affected developers' environments may still warrant review as a precaution.
MITRE ATT&CK techniques used in TL-2026-4820
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery
Lateral Movement
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.003 Scheduled Task/Job; T1053.005 Scheduled Task; T1098.004 SSH Authorized Keys; T1133 External Remote Services; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.007 Command and Scripting Interpreter
Command and Control
T1071.001 Web Protocols; T1571 Non-Standard Port; T1572 Protocol Tunneling
Initial Access
Affected products and versions in Malicious Anthropic.claude-code extension version 2.1.313
- Cursor — Cursor Extension Marketplace - Anthropic.claude-code extension (darwin-arm64, win32-x64)
Vulnerable versions: 2.1.313
Fixed in: Malicious version removed from the marketplace on 2026-10-29; uninstall 2.1.313 and run the vendor remediation script
Remediation for Malicious Anthropic.claude-code extension version 2.1.313
Patches
- Malicious version 2.1.313 was removed from the Cursor Extension Marketplace on 2026-10-29; uninstall it if present and note that uninstalling alone does not remove dropped persistence
Immediate actions
- Check for the svc-telemetry key in ~/.ssh/authorized_keys (macOS) and %USERPROFILE%\.ssh\authorized_keys plus C:\ProgramData\ssh\administrators_authorized_keys (Windows)
- Run Cursor's remediation script: remediate-macos.sh as the affected user (not root) or remediate-windows.ps1 as Administrator
- Block outbound traffic to 134.209.82.225 (TCP 8099 and TCP 22) at the perimeter and egress proxies
- Hunt for the SysMon scheduled task, com.apple.sysmond.plist LaunchAgent, sysmon.cmd Startup script, ~/.config/.smt and .smtk files, and ssh/autossh reverse-tunnel processes
- As a precaution, review credentials and tokens referenced by environment variables on hosts that installed Anthropic.claude-code 2.1.313 (vendor states only variable names were collected)
Workarounds
- Disable or remove the Anthropic.claude-code extension in Cursor until verified clean
- Disable SSH/Remote Login on developer machines where it is not required
Longer-term hardening
- Restrict extension installation in IDEs to an allowlist of vetted publishers and pinned versions
- Alert on new SSH authorized_keys entries, enabling of Remote Login/OpenSSH Server, and new LaunchAgents or scheduled tasks created by IDE processes
- Monitor developer endpoints for reverse SSH tunnels to untrusted hosts
Weaknesses (CWE) in Malicious Anthropic.claude-code extension version 2.1.313
Timeline of Malicious Anthropic.claude-code extension version 2.1.313
Showing the 20 most recent tracked events.
- Cursor community forum thread raised concerns about Cursor's Open VSX extension marketplace security and spoofable extension metadata.
- Earlier developer-tool supply-chain attack (LiteLLM 1.107.0) that Cursor links to this incident in its notice.
- Clean Claude Code extension v2.1.312 published (20:26 UTC per StepSecurity); adjacent versions later verified clean.
- Phorion and OpenSourceMalware researchers identify the malicious JavaScript loader injected into extension.js.
- Cursor released remediation scripts remediate-macos.sh and remediate-windows.ps1 to remove the extension, persistence, tunnel processes and the svc-telemetry SSH key.
- Cursor published a security notice stating at most 5,000 users were affected and listing IOCs, package SHA-256 hashes and detection commands.
- Cursor rotated cryptographic keys and rebuilt marketplace infrastructure after the incident.
- Cursor coordinated with the hosting provider to take the attacker server (134.209.82.225) offline; the hunt record notes the server no longer functions.
- Cursor blocked further distribution and temporarily shut down the marketplace while it audited access and confirmed no other extensions were compromised.
- Cursor detected the malicious version and removed it from the marketplace at 1:35 PM PT, roughly 11 hours after it was published.
- Malicious Anthropic.claude-code 2.1.313 (darwin-arm64 and win32-x64) became available on the Cursor extension marketplace at 2:27 AM PT.
- Microsoft published guidance to restrict extensions to approved publishers and to configure an extension installation cooldown that delays newly published versions.
- Microsoft documented Defender Antivirus detections (Trojan:MacOS/SmtShellMal.A, Trojan:JS/CredTheft.MS!MTB, Trojan:MacOS/MalPlistSysmond.A, HackTool:MacOS/RevAnthShell.A), Defender for Endpoint alerts and advanced hunting queries.
- Microsoft Security Blog published a technical analysis of the extension's loader, SSH key planting, reverse tunnel, persistence and IOCs.
- As reported in Microsoft's post, Anthropic confirmed that its systems were not compromised and that it did not develop the malicious package posted to the Cursor marketplace. Evidence indicates the incident was limited to the Cursor marketplace (not the Visual Studio Marketplace or npm).
- Expel publishes findings from four incidents at four customers (all macOS); one active tunnel was found without the svc-telemetry key in authorized_keys.
- Cursor updates its notice at about 11:30 PT (18:30 UTC) to add version 2.1.312 and correct IOCs.
- Expel observes first malicious activity in one incident at 04:45 UTC, about 8 hours after the exposure window closed; the tunnel is still active on the affected Mac at 14:29 UTC.
- BleepingComputer and security vendors publish analyses, including implementation flaws (unprivileged systemsetup call on macOS, /bin/sh on Windows) that prevented SSH activation on many hosts.
- Clean v2.1.314 published (01:07 UTC per StepSecurity); C2 infrastructure reported offline.
Update history for TL-2026-4820
- 2026-10-31 — Trojanized Claude Code-branded Cursor marketplace extension (anthropic.claude-code 2.1.312/2.1.313) deploys persistent SSH backdoor: What changed No change to severity (HIGH), exploitability (ACTIVE), status or attribution. Microsoft's independent analysis corroborates the existing record, including 2.1.312 and 2.1.313 as malicious. New indicators (4) 4 new Microsoft Def
- 2026-10-30 — Trojanized Claude Code Extension (v2.1.312/2.1.313) in Cursor Marketplace Installs SSH Backdoor: What changed Status MONITORING → ACTIVE: Expel saw malicious activity ~8 hours after the exposure window closed and a tunnel still active at 14:29 UTC on 2026-10-30, contradicting the 'contained' assessment. Affected versions extended to in
- 2026-10-30 — Trojanized Claude Code Extension (anthropic.claude-code 2.1.313) Pushed to Cursor Marketplace With SSH Backdoor and Reverse Tunnel: What changed No severity, exploitability or status change; the existing HIGH / ACTIVE / MONITORING values stay as they are. The update adds loader-level technical detail only. New indicators (4) 4 new indicators: the Linux @reboot cron pers
- 2026-10-30 — Trojanized Claude Code Extension (v2.1.313) on Cursor Marketplace Planted SSH Backdoors: What changed No severity/exploitability change (already HIGH / ACTIVE). Clean fixed version 2.1.314 now confirmed by third parties; adjacent 2.1.312 verified clean. Implementation flaws blunted SSH activation, but recon beaconing and env-va
Sources cited for Malicious Anthropic.claude-code extension version 2.1.313
- Security notice - malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace
- Cursor Extensions Marketplace security (Open VSX) - Cursor community forum (earlier marketplace concerns)
- How to not lose $500k to a malicious Cursor extension (related earlier Cursor extension incident)
- MITRE ATT&CK T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
- MITRE ATT&CK T1098.004 - Account Manipulation: SSH Authorized Keys
- MITRE ATT&CK T1572 - Protocol Tunneling
Detection coverage for TL-2026-4820
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4820 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.