A trojanized Claude Code extension reached the Cursor Marketplace too — here's a 7-point audit for your machine

In October 2026, a compromised version of the Claude Code extension (anthropic.claude-code@2.1.313) was found on the Open-VSX marketplace. This malicious build covertly installed an SSH key, attempted to enable remote login, created a reverse SSH tunnel to a malicious server, and installed persistence mechanisms specific to the operating system.

The OS-specific persistence included a disguised macOS LaunchAgent, a Linux cron @reboot entry, or a Windows scheduled task with a fallback to the Startup folder. This incident was not limited to Open-VSX, as the same malicious build was also discovered in the Cursor Marketplace. The Phorion advisory confirmed these findings and provided additional details on the Windows persistence mechanism.

This breach highlights the broader supply-chain issue that can affect any distribution channel, not just a specific editor. To help identify and mitigate such risks, a small open-source CLI tool called coding-agent-audit was created. This CLI tool implements the publicly documented indicators of compromise (IOCs) and includes additional configuration heuristics to catch potential attack patterns.

The tool provides both a machine-readable JSON output for integration into CI pipelines and a more human-readable output for quick triage. It is important to note that a clean scan result does not guarantee a machine is free of compromise, as it only checks against known patterns. The tool is MIT-licensed, open-source, and available for download without any registration or payment.