Backdoored Claude Code extension 2.1.313 on Open VSX (used by Cursor) plants an attacker SSH key and reverse SSH tunnel on developer machines

On 29 Oct 2026 a tampered build of Anthropic's Claude Code for VS Code extension (anthropic.claude-code 2.1.313) was published to Open VSX, the extension registry used by Cursor, Windsurf and other VS Code forks. Cursor confirms its marketplace served it on 29 Oct from 09:27 to 20:35 UTC, to up to 5,000 users. The malicious builds identified are macOS ARM64 and Windows x64 (as relayed by Florian Roth from Cursor's notice). Phorion and Paul McCarty (OpenSourceMalware) analysed it separately. A 66-line loader was added to the start of extension.js. It runs as soon as the editor loads the extension, with no Claude conversation needed. It adds an attacker SSH key (comment svc-telemetry) to ~/.ssh/authorized_keys, tries to switch on the local SSH server and opens a reverse SSH tunnel to 134.209.82[.]225. That gives the operator an interactive shell on the machine. It survives reboots on macOS, Linux and Windows. It also reports the hostname, user, git email, public IP, and the names (not the values) of environment variables that look like keys, tokens or AWS/GCP credentials. Anthropic pulled 2.1.313 from Open VSX and also from npm and the VS Code Marketplace as a precaution; 2.1.314 replaced it. Copies from the VS Code Marketplace and npm are not confirmed malicious. Anthropic has not published an incident notice. How the build was tampered with and who is behind it are unknown. On macOS the SSH step often fails because of a bug in the malware, but the key, persistence and beacon still land.

Summary written from the sources below. Check the originals before acting.