Lead Analysis
Claude Code extension trojanized in Cursor's marketplace: SSH backdoor hits up to 5,000 developer machines
A poisoned build of the official Anthropic extension sat in Cursor’s own marketplace for roughly 11 hours on October 29, planting a persistent SSH backdoor before it was pulled.
Saturday, October 31, 2026: Cursor confirmed that version 2.1.313 of the official anthropic.claude-code extension — served from Cursor’s own VS Code marketplace — ran malicious code installing a persistent SSH backdoor on up to 5,000 developer machines. Anthropic shipped a clean 2.1.314 the next day; the command server has been taken offline.
The incident window ran 2:27am to 1:35pm PT on October 29. The malicious build injected a 66-line loader that appended an attacker-controlled SSH key labelled “svc-telemetry” to ~/.ssh/authorized_keys, dropped a reverse-SSH tunnel to 134.209.82.225:22, and persisted via a “SysMon” scheduled task on Windows and a com.apple.sysmond LaunchAgent on macOS. Cursor pegs the blast radius at “at most 5,000 users” and says anyone who installed 2.1.313 should treat the machine as compromised.
The significance is not the number of victims — small, by supply-chain standards — but where the poison sat: no impersonation, no typosquat, this was the authentic extension listing in a vendor-run marketplace. The failure mode is the one EMBRACE research flagged this month for Cursor, Copilot, Codex and Claude Desktop: developers trust tool marketplaces as a chain of custody that simply does not exist. For Indian engineering teams running Claude Code, Copilot or Cursor agents inside regulated estates, this converts “provenance” from a checkbox into an audit rule.
Immediate India-relevant actions: inventory Cursor installs of Claude Code 2.1.313 (and earlier 2.1.x builds updated within the window); check ~/.ssh/authorized_keys for svc-telemetry; look for SysMon/LaunchAgent persistence; treat CI/CD secrets and deployment keys on affected machines as exposed and rotate them; then pin extensions to verified hashes and gate marketplace updates through an internal proxy where practical. The blast radius is small but the access it grants — developer workstations with pipeline credentials — is disproportionately valuable.
Two parallel threads carry the day for Indian enterprise. Amazon disclosed in its October 30 filing an up-to-$80 billion supplier-financing facility secured against hardware it buys — roughly 104% of Q3 capex — with draws from Q1 2027 to Q3 2028, funding AI capex that stays near $220B for 2026 with negative trailing free cash flow of $42.4B. That is hyperscaler AI buildout financed through the capital markets, not operating cash, and it is the same pattern visible across MAG5, which returned just 9.3% of operating cash flow to shareholders in 2026 after $556.9B of combined capex. For Indian cloud-services demand the signal stays positive; the funding structure is the new risk metric to watch.
On markets, the Nifty reclaimed 23,000 on Friday, closing at 23,053.10 (+0.51%) with the Nifty IT index up 2.5% — the AI-services complex finally joining the rebound two sessions after Infosys’ guidance cut. Sensex rose 308 points to 74,459.53 with Trent +5.2% on a 25% Q2 profit jump. The rupee opened firm at 95.22 and crude held near $116. Overnight, US equities saw a sharp technology-led selloff wiping more than a trillion dollars in value as investors questioned whether heavy AI investment will pay off — the tension between Friday’s IT rally in Mumbai and the global AI-capex reckoning will be the dominant question for Monday’s open in India.
