Microsoft has issued a warning regarding a series of malicious extensions dubbed “Claude Code,” which were distributed via Cursor’s marketplace and have been linked to attempts at installing a persistent SSH backdoor on developer workstations. The tech giant highlighted the growing concerns over cybersecurity vulnerabilities, particularly those that target software developers.
The troubling incident involved two particular versions of the compromised extension, anthropic.claude-code 2.1.312 and 2.1.313. These malicious packages ingeniously combined legitimate functionality with nefarious injections of JavaScript aimed at facilitating unauthorized remote access to users’ systems. The distribution of these trojanized packages raises significant alarm about the potential threats lurking within development environments, highlighting the increasing sophistication of cybercriminals.
On October 29, 2026, Cursor revealed the incident, confirming that the malicious extensions were accessible to developers between approximately 2:27 AM and 1:35 PM PDT. Following this disclosure, Microsoft confirmed that its Visual Studio Marketplace, as well as the Claude Code npm distribution, had remained unaffected by the malicious extensions.
In light of these developments, Anthropic, the company behind the legitimate Claude Code extensions, asserted that there had been no compromise of its systems and reiterated that it did not develop the malicious packages. The malicious functionalities embedded within these extensions activate upon loading the extension module, before the normal initialization processes can occur, further complicating detection efforts.
To carry out its intrusive actions, the malware employed Node.js APIs, which enabled it to gather sensitive information such as the hostname, username, operating system, architecture, and directories relevant to global Git configurations. Notably, the malware suppressed any errors to maintain the façade of normal extension operation, thus allowing it to remain undetected for longer periods.
In its attempt to establish remote access, the malicious extension scanned for authorized keys, looking specifically for a “svc-telemetry” marker. If this marker was not found, the malware appended its own embedded Ed25519 public key. To authenticate the outbound connection, a private key was hidden within a temporary file. The extension then issued a series of SSH arguments designed to request server-assigned remote port-forwarding connections to the local SSH service running on the affected workstation.
Further complicating matters, the extension disabled standard host-key verification and utilized retry loops to ensure continuous connectivity. Microsoft identified the malicious activity being directed to an IP address, 134.209.82[.]225, which served as a configured destination for both SSH and HTTP connections.
For macOS users, the persistence mechanisms involved creating an entry in the LaunchAgents directory, while Linux systems received a corresponding entry in the user crontab for reboot operations. Windows users faced attempts at creating a SysMon scheduled task, with a fallback scheduled task in the Startup folder. These persistence methods ensured that malicious files remained active and operational, even after the legitimate extension was removed or updated.
Despite all these alarming factors, Cursor reported that many users’ systems on macOS and Windows blocked the unauthorized SSH access attempts due to local configurations and administrator permission requirements. This aspect highlights the critical role of security settings in safeguarding systems against such threats.
In response to the potential infections from these malicious extensions, cybersecurity professionals are urged to identify affected installations and preserve both extension packages and host artifacts for further analysis. It is crucial to isolate devices that exhibited any loader execution or backdoor installation activities. Investigators are advised to correlate any suspicious network connections with unauthorized keys and tunnel processes, taking care to confirm that legitimate SSH configurations remain intact during the cleanup process.
The risks posed by such malicious software justify immediate action. Organizations are encouraged to rotate credentials and revoke sessions if there is any possibility of exposure. Enhancing security protocols by enforcing approved-publisher restrictions and implementing installation cooldown periods can significantly mitigate risks associated with malicious extension releases in managed developer environments.
To aid cybersecurity teams, Microsoft provided indicators of compromise (IOCs) associated with this malicious campaign. These indicators included specific IP addresses, URL patterns, filenames associated with temporary tunnel identities, and fingerprint hashes linked to unauthorized credentials. Carefully tracking these IOCs will be vital in thwarting future attacks that employ similarly deceptive tactics to compromise developer environments.
In summary, this incident serves as a stern reminder of the evolving landscape of cybersecurity threats and the importance of vigilance in software development ecosystems. With the stakes continually rising, understanding the nuances of these attacks is essential for all developers and organizations involved in software creation and distribution.