A malicious copy of Anthropic’s Claude Code extension was distributed through Cursor’s extension marketplace for roughly 11 hours on October 29, exposing as many as 5,000 developers to code that attempted to install a persistent SSH backdoor.
Cursor’s security notice identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as affected when they came from Cursor’s marketplace between 2:27 a.m. and 1:35 p.m. Pacific time. The company says the modified packages were not built by Anthropic, and Anthropic has separately said its systems and official distribution channels were not compromised.
The incident is narrower than a compromise of Claude Code itself, but it is serious for anyone inside the exposure window. The extension collected host details, planted an attacker-controlled SSH key, created persistence and repeatedly tried to open a reverse tunnel. Updating or uninstalling the extension does not necessarily remove the files and startup mechanisms it left behind.
What the malicious Claude Code extension did
The tampered extension added a small JavaScript loader to the otherwise legitimate package. Because editor extensions execute with the permissions of the editor process, the loader ran when the extension loaded; the user did not need to invoke Claude Code or approve a separate installer.
Cursor says the payload gathered the computer’s hostname, username, operating system, architecture, home-directory path, working directories, configured Git email, public IP address and the names of environment variables. The distinction between names and values matters, but it does not make the collection harmless. Names such as AWS_ACCESS_KEY_ID, GITHUB_TOKEN or a company-specific secret variable can tell an attacker which developer machines deserve further attention.
The payload then appended an Ed25519 public key labelled svc-telemetry to the user’s SSH authorized_keys file. It tried to enable the local SSH service and establish a reverse SSH tunnel to attacker infrastructure. On macOS it used a LaunchAgent for persistence; on Windows it attempted a scheduled task running as SYSTEM, with a Startup-folder script as a fallback. Background scripts retried the tunnel about once a minute.
Several implementation errors limited the attack. Cursor says enabling the SSH service would normally fail unless the editor was running with administrator privileges, an unusual configuration. That does not erase the exposure: the key could still be written, persistence files could remain, and reconnaissance data could be sent. The attacker’s server has since been taken offline, but defenders should not treat a dead command-and-control host as proof that a workstation is clean.
Who needs to check
The confirmed scope is Cursor users on Windows or macOS who installed or updated the Claude Code extension from Cursor’s marketplace during the October 29 window. Cursor estimated that no more than 5,000 users received the malicious package.
The Microsoft Visual Studio Marketplace, Open VSX and the official npm package were not affected, according to Anthropic, Microsoft and the registry records reviewed by security researchers. This was a marketplace-specific supply-chain incident, not a malicious release published across every Claude Code channel.
There is one version-detail wrinkle. Cursor’s current notice names both 2.1.312 and 2.1.313 for Windows and macOS, while independent package analysis has concentrated on the 2.1.313 build. Organizations should follow Cursor’s broader scope when deciding which machines to inspect rather than assuming 2.1.312 is safe based on version number alone.
How to check for the SSH key
Cursor’s quickest test looks for the svc-telemetry label appended to SSH authorized keys.
On macOS, run:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"On Windows, open PowerShell and run:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }A positive result is evidence of compromise. A negative result is useful but should be checked against extension-installation logs and endpoint telemetry, especially on managed developer fleets. Security teams should also hunt for the malicious extension directories, the dropped persistence files, unexpected LaunchAgents or scheduled tasks, and connections to the indicators in Cursor’s advisory.
What affected developers should do
Cursor recommends isolating systems that show payload execution or backdoor installation, then removing the unauthorized SSH key, persistence mechanisms and active tunnel processes. The company has published separate remediation scripts for macOS and Windows in its advisory. Run those scripts in the context Cursor specifies and verify that they exit successfully.
Do not stop at upgrading to a clean extension. Anthropic’s release history shows clean releases after the incident, but an extension update does not automatically undo standalone scripts, scheduled tasks, SSH configuration changes or an already established session.
Credentials and active sessions accessible from an affected machine should be rotated from a different, trusted device. Prioritize source-control tokens, cloud credentials, package-registry credentials, SSH keys, API keys, CI/CD secrets and any development certificates available to the user. Review Git hosting, cloud and identity-provider logs for activity that began during or after the exposure window.
A rebuild is the safer path when investigators find a successful SSH login, an active tunnel, unknown process execution, credential access or evidence that the attacker moved beyond the extension’s initial loader. Preserve forensic data before reimaging if the machine can provide evidence about access to company repositories or cloud accounts.
Why the marketplace matters as much as the publisher
The package appeared under Anthropic’s identity inside Cursor’s marketplace even though Anthropic did not create it. Cursor removed the package, shut down its marketplace, audited access, rotated keys and rebuilt the service. It says it found no evidence that other extensions were altered. The companies have not publicly explained how the malicious build entered the marketplace.
For security teams, that gap is part of the incident rather than a footnote. A familiar publisher name is not enough when the editor obtains extensions through a marketplace, mirror or proxy with its own authentication and signing path. Inventory should record both the extension and the distribution source.
Microsoft now documents a default 12-hour delay before VS Code automatically installs newly published extension updates, and enterprise administrators can manage that delay by policy. Cursor provides its own install-cooldown and extension-governance controls. A delay is not a substitute for signing, provenance checks and rapid detection, but it can keep a malicious release from reaching every workstation during its first hours online.
Organizations that allow editor extensions should maintain an approved list, log installation and update events, restrict developer tools from running with elevated privileges, and treat editor processes as access to source code and credentials rather than as low-risk desktop software. The Claude Code incident lasted less than half a day. Automatic distribution was enough to turn that window into a fleet-level response problem.
