Case trojan-claude-code-extension-sshAI supply chainWorldwide
Trojanized Claude Code extension 2.1.313 on Cursor Marketplace installs persistent SSH backdoor
A trojanized anthropic.claude-code 2.1.313, with a 66-line malicious loader prepended to the extension bundle, was distributed through the Cursor Marketplace for about 11 hours on 29 October 2026. It added an attacker SSH key, installed persistence and sent host details to an attacker server; Cursor says at most 5,000 users were affected. Phorion first reported it on Open VSX, but Socket found no evidence that version reached Open VSX or Microsoft's marketplace. How the attackers published the update is unclear.
HighAttack on AIStatus: contained; malicious version removed, method of compromise unclearVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 30, 2026
- Location
- Worldwide
- Target
- Cursor Marketplace users of the Claude Code extension (at most 5,000 users)
- Severity
- High
- Verification
- Reported by credible press or researchers
- Triggered by
- Unknown
- Actor type
- Unknown
- Sector
- Technology & AI vendors
- Reported loss
- None reported
- CVE
- None
What happened
A trojanized anthropic.claude-code 2.1.313, with a 66-line malicious loader prepended to the extension bundle, was distributed through the Cursor Marketplace for about 11 hours on 29 October 2026. It added an attacker SSH key, installed persistence and sent host details to an attacker server; Cursor says at most 5,000 users were affected. Phorion first reported it on Open VSX, but Socket found no evidence that version reached Open VSX or Microsoft's marketplace. How the attackers published the update is unclear.
Impact: Persistent SSH access to developer systems that install the package; number of victims is not stated.
Who triggered it
Actor: Unknown
Attribution: Unknown; the summary does not name an actor.
Motive: Unknown; likely remote access to developer systems.
How it happened
Attack vector: Trojanized extension package on the Open VSX registry with a malicious loader added to the legitimate code.
Root cause: A tampered extension was distributed through an open extension registry; how it was published is not stated.
Timeline
- Reported by GBHackers
Response
Researchers analysed the artifact; no takedown or vendor response is stated.
Current status: contained; malicious version removed, method of compromise unclear
Research warnings this case matches
- Seen in real incidents AI systems themselves become targets · International AI Safety Report
- Seen in real incidents Privacy and security · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- GBHackers gbhackers.com
- The Hacker News thehackernews.com
- Help Net Security helpnetsecurity.com
Cite this case
Trojanized Claude Code extension 2.1.313 on Cursor Marketplace installs persistent SSH backdoor. AI Threat Watch, case trojan-claude-code-extension-ssh, Oct 30, 2026. https://aithreat.io/cases/trojan-claude-code-extension-ssh/
Permanent link: https://aithreat.io/cases/trojan-claude-code-extension-ssh/
Related cases
The same type of incident, most recent first.