Claude Code Extension Tampered on Cursor Marketplace

A tampered Claude Code extension that tried to plant an SSH backdoor on developers’ machines was available in Cursor’s extension marketplace for about 11 hours on 29 October, and “at most 5,000 users were affected”, Cursor said in a security notice. The package, labelled Anthropic.claude-code version 2.1.313, “was not developed by Anthropic”, the company says.

The build was live from about 2:27am to 1:35pm Pacific time, or 09:27 to 20:35 GMT. It did not arrive through a lookalike listing: it sat under the Claude Code name in the marketplace Cursor users install add-ons from. Cursor says the most dangerous step failed on most computers, but the extension still left an attacker’s key and startup scripts behind, so removing it is not enough on its own.

In brief

Cursor says a modified Claude Code extension, version 2.1.313, was in its marketplace from 09:27 to 20:35 GMT on 29 October and affected at most 5,000 users.
It tried to add an attacker’s SSH key, switch on SSH and open a reverse tunnel; Cursor says the SSH step needs admin rights and fails on most Mac and Windows machines.
Cursor has not said how the package reached its marketplace; users who installed or updated in that window should run its check and remediation scripts and rotate credentials.

What the tampered Claude Code extension tried to do

According to Cursor, the modified Claude Code extension first collected details about the computer and its user: hostname, username, operating system, architecture, home directory, the names of environment variables, working directories, the configured Git email address and the public IP address.

It then tried to append an attacker-controlled key, labelled svc-telemetry, to the user’s SSH authorized_keys file, switch on the local SSH service and open a reverse SSH tunnel to the attacker’s server. To survive a restart, it installed a LaunchAgent on macOS and, on Windows, a scheduled task that tries to run as SYSTEM, with a Startup-folder script as a fallback. Background scripts retry the tunnel roughly every 60 seconds, and the extension reported host details and the backdoor’s status by HTTP to a /beacon address on port 8099.

Cursor says turning on SSH “requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel.” It adds that the extension “still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker.” The company says it worked with the cloud provider hosting the attacker’s server to take it offline, so the tunnel and the reporting no longer work.

Cursor shut down and rebuilt its marketplace

Cursor says it removed version 2.1.313 as soon as it was detected, blocked further distribution and then shut down its whole VS Code extension marketplace “out of an abundance of caution”. It says it audited access, “confirmed no other extensions were tampered with”, rotated its keys, rebuilt the marketplace and brought it back online. It will contact affected users directly.

The company repeated the 5,000 ceiling on its verified X account on Friday morning, adding: “It does not impact other extensions”. Its notice says Cursor has “no evidence that other versions of the extension or the official distribution are affected”. When a widely shared X post said the official Claude Code extension itself had been compromised, Cursor chief executive Michael Truell replied that Cursor had spoken with the author of the blog behind it and did not believe “the official Claude Code VS Code extension was compromised”, calling the blog “instead a report of this incident”.

Reuters, reporting the incident, described Cursor as “the coding-tool company owned by SpaceX” and said Anthropic did not immediately respond to a request for comment. Cursor announced in August that it had been acquired by SpaceX. The marketplace has grown in importance as Cursor has added an Origin app marketplace with partner apps and an Agent SDK for building agents as code.

How to check a machine for the svc-telemetry key

The advice applies to anyone who installed or updated to Anthropic.claude-code 2.1.313 from the Cursor marketplace during the window. Cursor’s quick test looks for the attacker’s key comment. On macOS it is:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

The notice gives an equivalent PowerShell command for Windows that also checks the administrators’ key file. If the key is there, Cursor says to isolate the machine, run its remediation script (the macOS script as the affected user, not as root; the Windows script from an administrator PowerShell) and consider rebuilding it. “Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” the notice warns.

Cursor also tells affected users to rotate credentials and sessions reachable from those machines, from a trusted system, because the limited collection of environment-variable names “does not rule out later credential access over the backdoor”. For security teams, it lists indicators: the attacker address 134[.]209[.]82[.]225 on ports 22 and 8099, a LaunchAgent named com.apple.sysmond, a Windows scheduled task called SysMon and hidden files under ~/.config.

The backdoor’s failed step does not make the clean-up unnecessary

Cursor’s reassurance about admin rights answers one question: whether the attacker could log in through the tunnel. On most Mac and Windows machines, it says, they could not. But the rest of the payload did run. A host where SSH stayed off can still hold the attacker’s key, persistence scripts that keep retrying, and a record of its details already sent to a server Cursor has since helped take down. A key in authorized_keys is only inert for as long as SSH stays off, which is why Cursor tells users to remediate “regardless”.

The notice is also slightly at odds with itself. One passage says the key, SSH and tunnel step “would fail” because of “errors in the malicious code” unless Cursor ran with admin rights; another says the extension still adds the key. The one-line check settles the matter on any given machine in a way the prose does not. Cursor’s checks and scripts cover macOS and Windows only.

The wider lesson echoes earlier TSN coverage of coding-tool risk, from Noma’s SneakPeek flaw in Claude Code’s desktop preview pane to Chainguard’s tools for containing coding agents. Here, the trusted name on the listing was the attack. Cursor has not said how a modified package reached its marketplace under Anthropic’s extension name, and Anthropic had not commented by the time Reuters published. Those two answers, and the direct notices Cursor says it will send to affected users, are what to look for next.