Security researchers have identified malicious code in an artifact presented as version 2.1.313 of the Claude Code extension from the Cursor Marketplace. According to an analysis by OpenSourceMalware, a 66-line loader was inserted ahead of the legitimate extension bundle and could execute when the extension loaded, without the user starting a Claude conversation.
The analysis draws important boundaries around the finding. It says the affected artifact identifies itself as `anthropic.claude-code` version 2.1.313 and reports that the Cursor Marketplace version was compromised. It separately states that the `@anthropic-ai/claude-code` npm package and Microsoft's Visual Studio Code marketplace extension were not malicious. The provenance of the examined directory was not independently established, so the artifact alone does not prove that Anthropic's official marketplace release or its distribution infrastructure was breached.
Static inspection found that the injected loader imported system, file, network and cryptographic modules before handing execution to the expected extension code. The malicious section attempted to add an attacker-controlled Ed25519 key to the user's `authorized_keys` file, enable an SSH service and create a reverse SSH tunnel to an operator-controlled server. It also gathered host reconnaissance and sent a beacon over unencrypted HTTP.
The persistence mechanism varied by operating system. On macOS, the code created a user LaunchAgent; on Linux, it wrote files under the user's configuration directory and added an `@reboot` cron entry. On Windows, it attempted to create a startup task named SysMon and fell back to the user's Startup folder if that could not be confirmed. Many errors were suppressed, allowing the legitimate extension to continue even when malicious steps failed.
Researchers found no secondary payload downloaded by the injected stage. The necessary scripts and tunnel keys were embedded in the extension. That limitation does not make the implant harmless: an established reverse tunnel could give the operator a route to the victim's SSH service, after which activity would no longer be visible in a static review of the original package.
The report recommends that anyone who loaded the affected artifact disconnect the system, preserve forensic evidence and inspect SSH keys, user persistence entries and long-running `ssh` or `autossh` processes. Credentials accessible to the affected account should be rotated from a known-clean system after evidence is collected.
Because the report is based on one malware analysis and the supply-chain path remains incompletely established, users should treat the technical indicators as actionable while avoiding broader conclusions about other Claude Code packages that the evidence does not support.
