Tampered Claude Code extension in Cursor's marketplace tried to plant SSH backdoors
Up to 5,000 developers may have received the fake update during an 11-hour window. Anthropic says it did not build or publish it.
Cursor says that between about 2:27 a.m. and 1:35 p.m. PT on October 29, its VS Code extension marketplace offered a maliciously modified copy of the Claude Code extension, labeled Anthropic.claude-code versions 2.1.312 and 2.1.313, for Windows and macOS. A short loader added to the front of the extension ran as soon as the editor started, with no Claude chat required. It reported host details back to an attacker's server, including username, hostname, Git email, public IP and the names of environment variables that look like secrets. It also tried to add an attacker's SSH key, open a reverse SSH tunnel and set itself up to survive reboots.
Cursor says up to 5,000 users may be affected and that, because of bugs in the malware, the backdoor step usually failed unless Cursor was running with administrator rights. The reconnaissance data was still sent. Cursor pulled the package, helped take the attacker's server offline and plans to contact affected users. Some researchers say the bad build also passed through Open VSX. Anthropic's Felix Rieseberg said Anthropic's systems and employee laptops were not compromised, and that someone used access to Cursor's marketplace to publish a copy Anthropic did not build. Anthropic has pushed version 2.1.314.
If you use Claude Code in Cursor, update the extension and look in ~/.ssh/authorized_keys for a key labeled svc-telemetry. Cursor's notice includes remediation steps.
- Bad versions
- 2.1.312, 2.1.313 (Cursor marketplace)
- Exposure window
- ~11 hours, Oct 29
- Users possibly affected
- Up to 5,000
- Clean version
- 2.1.314