Trojanized Claude Code extension on Cursor's marketplace planted SSH backdoors on developer machines

A malicious update to the Claude Code extension, Anthropic's AI coding assistant for VS Code-based editors, was distributed through the Cursor Marketplace on October 29 under the extension's legitimate identifier, anthropic.claude-code. According to The Hacker News, users installed the tampered version 2.1.313 between roughly 2:27 a.m. and 1:35 p.m. Pacific time, after which Cursor briefly took its marketplace offline to remove it. Cursor says at most 5,000 users were affected and that it will contact them directly.

What the malicious code did

Researchers at OpenSourceMalware and independent researcher Paul McCarty found that a 66-line loader had been placed at the top of the extension's main JavaScript file, while the rest of the code matched the genuine release, so the assistant kept working normally. The loader ran as soon as the extension loaded. It added an attacker-controlled key labelled "svc-telemetry" to the user's SSH authorized keys, tried to switch on the SSH service, and opened a reverse tunnel to an external server. It also installed persistence through a LaunchAgent on macOS, a cron entry on Linux or a scheduled task on Windows.

The loader sent a beacon over unencrypted HTTP containing the hostname, username, operating system, Git email address and the names, but not the values, of up to 40 environment variables that looked like credentials or cloud keys. Cursor notes that enabling SSH usually fails on macOS and Windows without administrator rights, although the key and persistence steps still run. No further payload has been observed.

Scope and response

Both reports say the compromise originated in Cursor's own marketplace. They found no evidence that the tampered build reached Open VSX, Microsoft's VS Code Marketplace or the @anthropic-ai/claude-code npm package. Cursor stated that the malicious version was not developed by Anthropic, and Anthropic has published a clean version 2.1.314. Neither report includes a direct statement from Anthropic.

Open questions and advice

How the attackers obtained the ability to publish under the official extension name remains unclear, as do their identity and whether the SSH access was used. Users who installed the extension in Cursor during the window are advised to isolate the machine, delete the "svc-telemetry" key and the persistence entries, rotate credentials and sessions, and update to 2.1.314 or later. Because auto-update could have pulled in the bad version silently, developers who rely on it should check which version they ran on October 29.