Supply chain · Briefing
Cursor removes malicious Claude Code extension after marketplace compromise
A modified extension distributed through Cursor’s marketplace added unauthorized SSH access and persistence. Defenders should establish installation provenance and investigate affected developer hosts.
Kinwilder research desk · · AI-assisted analysis
What is established
A malicious Claude Code extension distributed through Cursor’s marketplace created a developer-host incident requiring investigation beyond extension removal. The Hacker News, published October 30, 2026, reports Cursor’s estimate of at most 5,000 affected users who installed it between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. Identifying itself as anthropic.claude-code version 2.1.313, it added an SSH key, attempted reverse tunneling and installed persistence. The malicious extension was removed; Anthropic had published 2.1.314 to Open VSX and Microsoft’s marketplace.
Socket’s report, published October 30, 2026, says Cursor rotated keys and rebuilt its marketplace. Socket found no corresponding publication or removal records in Open VSX, or publication-history entry in npm. It had not obtained the reported artifact for analysis. That distinction makes the distribution channel central to exposure assessment.
Who is behind it
Attribution is not established in either supplied report. No operator, state association, ransomware affiliate or operator location is identified. The Hacker News reports that Anthropic did not develop the malicious modification. A familiar publisher identity therefore cannot establish the malicious package’s authorship.
Our analysis
Analysis: The apparent trust boundary crossed was between software obtained through a marketplace and code permitted to execute inside a developer’s account. An extension installation can become an endpoint security event when the installed code changes authentication settings or arranges execution outside the editor.
The authorization invariant is straightforward: installing an editor extension should not authorize an unknown party to access the developer’s account. Changes to SSH authorization must reflect a separate, deliberate administrative decision. A marketplace listing or familiar package name cannot substitute for that authorization.
The reported persistence means an extension uninstall alone cannot demonstrate recovery. Investigation should ask whether execution created durable access elsewhere on the host and whether that access was subsequently used. An attempted tunnel also does not establish a successful interactive session.
Potential exposure should be scoped through installation provenance. A matching product name in an inventory is a starting point; package origin, installation timing and host evidence determine whether a machine belongs in the incident. Watch for additional artifact verification and evidence distinguishing attempted access from completed access.
Defensive actions
The Hacker News relays guidance to isolate affected hosts, remove unauthorized keys and persistence, and rotate credentials and sessions.
Kinwilder’s defensive recommendations, in priority order:
- Identify installations from the affected marketplace and window above. Preserve extension files, installation records and relevant endpoint telemetry before cleanup. Ask whether inventory records retain the actual distribution source or only the extension identifier.
- Investigate authentication changes and persistence together. Review SSH authorization files, scheduled execution settings, process ancestry, authentication logs and outbound connection history. Correlate changes with editor activity; a single unfamiliar entry needs context before attribution.
- Establish whether remote access succeeded. Look for accepted authentication, session activity and subsequent account changes. Preserve the distinction between an attempted connection, an established tunnel and an authenticated session when documenting findings.
- Scope credential rotation to the account’s reachable resources. Review cloud, source-control and automation access, including active sessions. Perform recovery from a trusted environment and verify that unauthorized access mechanisms are gone before restoring connectivity.
- Harden extension management. Record approved publishers and distribution channels, retain package hashes where feasible, and alert when editor processes modify authentication or startup settings. Confirm replacement packages through publisher-controlled records rather than relying on a version label alone.
Key concepts
- SSH authorized key: An entry that can permit a particular private-key holder to authenticate to an account, subject to SSH configuration.
- Reverse tunnel: A connection initiated outward that can provide a route back to a local service. Connectivity alone does not prove successful login.
- Persistence: A mechanism that lets code or access survive the original process ending or the host restarting.
- Provenance: Evidence connecting a particular file to its publisher, distribution channel and installation history.
Limits
The reports share underlying Cursor statements, so two publishers do not independently corroborate every detail. Socket’s registry findings have a defined review scope and do not establish that every possible publication attempt was impossible. Victim organisations, sectors and countries are unspecified. Successful access and downstream data theft remain unestablished here. Kinwilder did not obtain, execute or reproduce the artifact.
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.