---
title: "Discussion on \"A verified publisher name, 11 hours of distribution, and one SSH key that stays behind: the fake Claude Code extension on Cursor Marketplace\" | Hashnode"
description: "Discussion on \"A verified publisher name, 11 hours of distribution, and one SSH key that stays behind: the fake Claude Code extension on Cursor Marketplace\". Summary\nOn October 29, 2026, two versions of the Anthropic.claude-code extension — 2.1.312 and 2.1.313 — appeared on the Cursor VS Code Extension Marketplace with malicious code injected. The distribu"
url: "https://hashnode.com/posts/claude-code-extension-cursor-ssh-backdoor-en/6af521707f684f460a365300"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [A verified publisher name, 11 hours of distribution, and one SSH key that stays behind: the fake Claude Code extension on Cursor Marketplace](https://blog.fiscybersec.com/claude-code-extension-cursor-ssh-backdoor-en?utm_source=hashnode&utm_medium=feed)

Summary On October 29, 2026, two versions of the Anthropic.claude-code extension — 2.1.312 and 2.1.313 — appeared on the Cursor VS Code Extension Marketplace with malicious code injected. The distribu

1h ago · 13 min read · blog.fiscybersec.com  
Read the article

-   [#supply-chain](https://hashnode.com/tag/supply-chain)
-   [#ide-extension](https://hashnode.com/tag/ide-extension)
-   [#cursor](https://hashnode.com/tag/cursor)
-   [#claude-code](https://hashnode.com/tag/claude-code)
-   [#ssh-backdoor](https://hashnode.com/tag/ssh-backdoor)
-   [#reverse-tunnel](https://hashnode.com/tag/reverse-tunnel)
-   [#developer-security](https://hashnode.com/tag/developer-security)
-   [#vs-code-marketplace](https://hashnode.com/tag/vs-code-marketplace)
-   [#persistence](https://hashnode.com/tag/persistence)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)

## Written by

[Vũ Nhật Lâm](https://hashnode.com/@kami61)

@kami61

  
[View profile](https://hashnode.com/@kami61)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.