{"id":246244,"date":"2026-10-31T03:26:25","date_gmt":"2026-10-31T08:26:25","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors"},"modified":"2026-10-31T03:26:25","modified_gmt":"2026-10-31T08:26:25","slug":"malicious-claude-code-extension-on-cursor-planted-ssh-backdoors","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors","title":{"rendered":"Malicious Claude Code extension on Cursor planted SSH backdoors"},"content":{"rendered":"\n<p>A malicious version of Anthropic\u2019s Claude Code VS Code extension was distributed through Cursor\u2019s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.<\/p>\n<p>The extension used the version number 2.1.313 and was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time.<\/p>\n<p>Cursor is an AI-powered code editor built from Microsoft\u2019s open-source Visual Studio Code (VS Code), with support for VS Code extensions. Anthropic\u2019s Claude Code extension brings its AI coding assistant directly into compatible editors, helping developers write and debug code using natural-language instructions.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A malicious version of Anthropic\u2019s Claude Code VS Code extension was distributed through Cursor\u2019s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. The extension used the version number 2.1.313 and was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,6],"tags":[],"class_list":["post-246244","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=246244"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246244\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=246244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=246244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=246244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}