A Tampered Claude Code Extension Reached Developers Through Cursor's Marketplace, and Nowhere Else

Cursor reported on Oct. 29, 2026, that a tampered copy of the Claude Code extension had been served from its own extension marketplace, and Microsoft Threat Intelligence published its analysis of the code a day later. The package was anthropic.claude-code at versions 2.1.313 and 2.1.312, and Microsoft says the code inside it tried to open an SSH backdoor, a hidden remote-access route, into the machine that installed it.

Only that one channel carried it. Microsoft's analysis says the tampered versions were never published or distributed through the Microsoft Visual Studio Marketplace or the npm package, and that neither was affected. Microsoft says Anthropic confirmed its own systems were not compromised and did not develop the package, and that all evidence at this time suggests the incident is limited to the Cursor marketplace.

Cursor reports the two versions were live from about 2:27 AM to 1:35 PM Pacific Daylight Time. Cursor also reports that errors and administrator-permission requirements blocked remote access on most macOS and Windows machines.

Microsoft says the code ran as the extension loaded, and that whether remote access worked depended on the machine's privileges, its configuration, and the attacker's own server. Microsoft says files could be left behind that would try to restore the connection after a restart, even where the connection itself failed.

Microsoft says the code also looked for the names of environment variables that commonly hold credentials and sent those names rather than their values, which it says does not demonstrate that the secrets themselves were taken.

Microsoft's guidance is to find systems that installed or automatically updated to those versions from the Cursor marketplace, preserve evidence, remove confirmed malicious files, review endpoint and network telemetry, and rotate credentials where an investigation shows exposure. Microsoft adds that removing or updating the extension does not remove files written outside its own directory, and that Cursor has published platform-specific checks and remediation scripts in its security notice.