Cursor Urges Credential Resets After Malicious Claude Code Extensions Hid SSH Backdoors in Marketplace Why Uninstalling Is Not Enough

A sophisticated supply-chain attack hidden inside popular developer tooling has forced code editor Cursor to warn users that simply uninstalling a malicious extension may not be enough to remove it. The incident, which involved poisoned versions of the Claude Code extension distributed through Cursor’s own marketplace, is a wake-up call for the enormous population of crypto developers who build wallets, trading bots, and decentralized applications on the same machines that hold their credentials.

What Happened

According to Cursor’s security notice, the malicious packages were Anthropic.claude-code versions 2.1.312 and 2.1.313 for macOS and Windows. They were available in the marketplace during an roughly eleven-hour window between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, 2026. Cursor emphasized that Anthropic did not develop the malicious versions and that there is no evidence other versions or the official distribution channel were affected.

The scale of the attack came into focus over the following days. Cursor clarified the affected versions and indicators on October 30, and security research firm Phorion updated its malware analysis on October 31 to include both poisoned builds, having initially identified only one. The researcher’s technical breakdown reveals a payload designed not to steal data immediately, but to quietly hold the door open for future access.

Why Uninstalling Is Not Enough

This is the part every developer needs to internalize. According to Phorion’s analysis, the payload attempts to add an attacker-controlled SSH key to the infected machine, enable the system’s SSH remote-login service, and establish a reverse tunnel back to attacker infrastructure. With SSH running and the planted key in place, an attacker could log into the machine through that tunnel at will, from anywhere.

The persistence mechanisms are what make cleanup so tricky. On macOS, the malware installs a LaunchAgent, a standard system mechanism that automatically re-launches components at login. On Windows, it attempts to create a scheduled task with a fallback that drops a file into the Startup folder. In both cases, removing the extension from your editor leaves these components behind, quietly running on every reboot.

The malicious code executes the moment Node loads the extension module, before the extension’s normal activation callback even fires. That means a user who installed the package and never clicked a single button in it could still be infected. The initial beacon reported host information and the names of up to 40 matching environment variables, not their secret values. But Cursor cautions that this limited initial collection does not rule out later credential harvesting through the backdoor.

There are some natural limits on the damage. Phorion found that a permission-check bug causes the macOS code to skip enabling Remote Login when run as a standard user rather than an administrator. But if SSH was already enabled on the machine, or got enabled later, the planted key could still grant access while the tunnel was operational.

Why Crypto Developers Are the Ones Who Should Panic-Clean

Neither advisory establishes any cryptocurrency theft or crypto-specific targeting, and Cursor says it worked with the hosting provider to take the attacker’s server offline, removed the packages, rotated its keys, and rebuilt and reopened the marketplace. But those server-side fixes do nothing about components already planted on individual machines.

For crypto developers, the exposure profile is uniquely bad. Anyone who installed the malicious versions during the eleven-hour window should assume that every credential accessible to their local user account may have been reachable by the backdoor. That list typically includes exchange API keys with withdrawal permissions, wallet seed phrases stored in password managers or dotfiles, private keys for test deployments, SSH keys to production servers, deployment tokens, and cloud credentials. A single reverse SSH tunnel into a machine like that is functionally a master key to someone’s entire crypto life.

Cursor’s guidance is appropriately aggressive. The company recommends checking endpoint, network, and extension-installation records to identify affected hosts, isolating any machine that shows signs of payload execution, and removing unauthorized SSH keys, persistence mechanisms, and running tunnels. It also provides platform-specific remediation scripts and advises administrators to assess whether a compromised host should simply be rebuilt from scratch. Most importantly, all credentials and sessions accessible from affected machines should be rotated from a known-trusted system, not from the possibly compromised one.

The Bigger Lesson

This attack is part of a disturbing trend. The Bybit hack began with malware disguised as legitimate development tooling on a wallet developer’s machine. The Binance breach reportedly began with a compromised employee laptop. Attackers have clearly learned that the cheapest way to steal billions is not to break cryptography, but to poison the tools developers already trust.

For anyone in crypto, the takeaway is simple: treat every editor extension, package update, and marketplace dependency as potential attack surface, keep development machines separate from machines holding significant funds, and never let a seed phrase live anywhere near a machine that auto-updates software. The eleven hours a poisoned extension sat in a trusted marketplace should change how the whole industry thinks about developer security.

Disclaimer: This article is for informational purposes only and does not constitute security or financial advice.