Cursor marketplace served backdoored Claude Code extension

Cursor disclosed that a malicious copy of Anthropic's Claude Code extension, version 2.1.313, was available in its VS Code extension marketplace from about 2:27am to 1:35pm PT on October 29. Anthropic did not build that version. Cursor says at most 5,000 users were affected and that it will contact them directly.

According to Cursor, the payload collected host and user details: hostname, username, OS, environment variable names, the configured Git email and public IP. It then added an attacker-controlled SSH key, labeled svc-telemetry, to the user's authorized keys. It also tried to enable the local SSH service and open a reverse SSH tunnel, kept alive by a macOS LaunchAgent or a Windows scheduled task. Turning on SSH requires admin rights, and the code contained errors, so Cursor says the tunnel step would have failed on most macOS and Windows machines. Even on those machines, the key, the persistence scripts and the beacon to the attacker were still installed.

Cursor pulled the version as soon as it was detected and then shut down the whole marketplace as a precaution. It says it found no other tampered extensions. It rotated its keys, rebuilt the marketplace and brought it back online. Cursor also worked with the hosting provider to take the attacker's server offline. Cursor has not said how the package got into the marketplace.

Users who installed 2.1.313 should check for the svc-telemetry key. Cursor warns that uninstalling the extension may not be enough, because the persistence scripts keep running on their own. It has published remediation scripts and indicators of compromise, and advises rotating any credentials reachable from affected hosts.