A tampered Claude Code extension sat in Cursor's marketplace for roughly 11 hours with an SSH backdoor

A maliciously modified copy of Anthropic's Claude Code extension sat in Cursor's extension marketplace for about 11 hours on October 29, according to Cursor. The company says the package, version 2.1.313, was available from roughly 2:27 a.m. to 1:35 p.m. Pacific Time and ran code that tried to install a persistent SSH backdoor. Cursor says at most 5,000 users were affected.

Anthropic did not build the package. Anthropic says the incident only affects Cursor users and is not a compromise of its own systems, and Microsoft's analysis notes that 2.1.313 was never published to Open VSX or the Microsoft marketplace. How the attacker got into Cursor's marketplace has not been publicly explained, BleepingComputer reports.

Cursor says the code collected the hostname, username, operating system, home directory, environment variable names, the Git email and the public IP address. It then tried to add an attacker key labeled svc-telemetry to authorized_keys, enable SSH and open a reverse tunnel, and it installed persistence through a macOS LaunchAgent or a Windows scheduled task that retried about every 60 seconds. Because of coding errors, the tunnel step would fail outside unusual conditions, Cursor says, but the key, persistence and data beacon still ran. Researchers at Phorion described the same mistakes.

Cursor removed the version, shut down and rebuilt the marketplace, rotated keys, and worked with the host to take the attacker's server offline. It found no evidence other extensions were tampered with. Its advice: if you installed or updated the extension during the window, check authorized_keys for the svc-telemetry key, run Cursor's macOS or Windows remediation script, rotate credentials reachable from the machine, and consider rebuilding the host. Uninstalling alone is not enough because standalone persistence scripts keep running.

For developers this is a reminder that editor extensions run with your permissions, and an official-looking name from a marketplace is not proof of safety. AI coding tools make the point sharper, since they are built to read files and run commands. Pin or review extension updates where you can, and keep secrets out of environment variables on dev machines.

Open questions remain, including how the publish happened and who is behind it. Cursor's security notice and Microsoft's write-up list the file hashes and network indicators for anyone hunting across a fleet.

Building with AI? See this week's hot AI repos and how to use each one.