Cursor confirms trojanized Claude Code v2.1.313 extension hit up to 5,000 users with SSH backdoor
cyb3rops · x · 2026-10-30
- Cursor confirmed a trojanized Anthropic.claude-code v2.1.313 in its extension marketplace on Oct 29, 09:27–20:35 UTC, affecting an estimated 5,000 users on macOS ARM64 and Windows x64.
- Loading the extension runs malicious code that collects host info and attempts a persistent SSH backdoor. Cursor says SSH access mostly failed due to bugs and insufficient privileges, but code execution still puts accessible credentials and repos at risk.
- The package is removed and C2 taken offline, but uninstalling may leave persistence behind: investigate affected hosts, remove persistence, and rotate credentials from a clean machine.
More from coding & agent
- Dev shows Hermes delegation routes: cost-weighted routing across six models per task type — intellectronica · 2026-10-30
- Lenovo ThinkSmart View boots mainline Linux 7.x, turning the $30 device into a Claude/OpenAI speaker — DavidBennett__ · 2026-10-30
- Physio student vibe-codes a full rugby club S&C app with Claude — Efficient-Rooster688 · 2026-10-30
- Building an enterprise MCP gateway with Azure APIM and Entra: per-client read/write control — Short-Legs-Long-Neck · 2026-10-30
- How an engineer broke the x402 agent payment protocol 20 ways, including a 10x overcharge — AI Engineer · 2026-10-30
- Obsidian Starter Kit v5 ships self-filing archives and on-demand AI skill loading — dSebastien · 2026-10-30