Cybersecurity experts revealed that the official Anthropic Claude Code extension on the Cursor Marketplace was compromised, allowing for the installation of a persistent SSH backdoor on infected hosts This article explores cursor marketplace compromised. . This issue was traced back to the Cursor Marketplace compromise, leading the AI coding platform to temporarily shut down the service to remove the malware.
As of October 30, 2026, the malicious version has been removed, and Anthropic has released version 2.1.314 for both Open VSX and Microsoft VS Code Marketplace." The extension is activated after VS Code starts and when its webview opens. It establishes a reverse tunnel to "134.209.82.225," installs platform-specific persistence via scheduled tasks, crontab, and LaunchAgent, and transmits host reconnaissance data to "134.209.82.225:8099/beacon" on port 8099 via an unencrypted HTTP request.
The collected data includes: Public IP address from ipify.org, hostname and local username, operating system and CPU architecture, home directory and current working directory, global Git email from git config --global user.email, and names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP. Even better, a successful SSH login would give the operator direct access to the account." No other follow-on payloads have been detected.
Users who installed the compromised extension during this period are advised to isolate their hosts, remove unauthorized SSH keys and persistence mechanisms, and rotate credentials and sessions.
