An extension presented as Claude Code was published with malicious code in Cursor Marketplace. Cursor says versions 2.1.312 and 2.1.313 may have reached up to 5,000 users. The code attempted to install a persistent SSH backdoor; successful remote access depended in part on the host’s privileges and configuration.
Scope matters: available sources describe the extension distributed through Cursor Marketplace. They do not report that the official Visual Studio Marketplace, Open VSX, or npm channels were affected.
An impersonating extension
The extension reused Claude Code’s name and appearance. According to Cursor and Microsoft, the malicious code attempted to add an attacker-controlled SSH key, enable the SSH service, and establish a reverse tunnel. Cursor says enabling the service required administrator rights and would fail on most affected hosts. The code could still write persistence artifacts and send host information even if the tunnel did not work.
The figure of 5,000 is Cursor’s estimate of potential reach, not a confirmed count of compromised machines. Installation of an affected version should still be treated as an incident to investigate.
Check the source and version
Development teams should verify the extension identifier, origin, and version on relevant workstations. If version 2.1.312 or 2.1.313 from Cursor Marketplace was installed, isolate the workstation under your incident procedure and follow guidance from Cursor and Microsoft.
Microsoft’s analysis recommends looking for associated SSH keys and persistence, then rotating credentials that may have been accessible from the machine. Reinstalling the editor alone does not prove that persistent components have been removed.
A software supply-chain incident
Editor extensions can have broad access to a developer’s files and tools. A compromised release can therefore turn a trusted installation into an entry point. Teams can reduce exposure by allowing only necessary extensions, verifying the publisher and official channel, and reviewing unexpected updates.
These practices cannot guarantee that a legitimate extension will never be compromised. They do make installations more visible and support a focused response when a security notice appears.
What is confirmed and what is not
Microsoft published a technical analysis of the backdoor, and Cursor described the version range and potential reach. Installation estimates should not be confused with confirmed infections. Public reports scope distribution to Cursor Marketplace; check with the vendors for any new information.
Soclyde’s connection
Soclyde helps teams keep credentials in an encrypted vault stored on their devices. This can help organise access that needs review after an incident, but it does not detect a backdoor or clean an infected workstation. See our guide to local versus cloud storage for ways to structure credentials.
What to remember
A Claude Code impersonator distributed a backdoor through Cursor Marketplace for a limited period. Check installed versions, handle affected systems through your response process, and rotate credentials that may have been accessible. Do not extend the incident to other channels without evidence.
