The Pulse
Cursor Finds Malicious Claude Code Extension in Its Marketplace
Cursor says modified copies of the Claude Code extension, versions 2.1.312 and 2.1.313, were available in its marketplace for about 11 hours on October 29. The package attempted to install an SSH backdoor and collect host details.
AI.info Team · Written with AI · fact-checked ·
“The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.”
Cursor Team
Versions 2.1.312 and 2.1.313 appeared for 11 hours
Cursor says a maliciously modified copy of Anthropic’s Claude Code extension was available through the Cursor VS Code extension Marketplace on October 29. The affected packages identified themselves as Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS, and Cursor says they were not developed by Anthropic. It was listed from about 2:27 a.m. to 1:35 p.m. Pacific Time.
The company’s notice concerns those versions: Cursor says it has no evidence that other versions of the extension or the official distribution were affected. Its account does not explain how the altered package entered Cursor’s marketplace.
The extension tried to leave a way back in
When run, the malicious code gathered details including a machine’s hostname, username, operating system, architecture, home-directory path, working directories, configured Git email and public IP address. It also collected environment-variable names, which can reveal what kinds of credentials or services a developer’s system uses, though Cursor says this was limited collection and does not say the extension directly copied credential values.
The package attempted to add an attacker-controlled SSH key labeled svc-telemetry to the machine’s authorized keys, enable local SSH and open a reverse SSH tunnel. It also tried to keep that tunnel available through a macOS LaunchAgent or a Windows scheduled task, with background scripts retrying about once a minute. The extension sent host details and backdoor status to an attacker-controlled server over HTTP.
Cursor says the SSH-enabling step requires administrator rights, which the extension would not have on most macOS and Windows machines. Because of errors in the malicious code, that step would fail in ordinary circumstances, limiting the attacker’s ability to log in through the tunnel. But Cursor warns that the key, persistence files and host reporting could still remain; failure of the tunnel does not mean an installation was harmless.
Cursor took down and rebuilt its marketplace
Cursor says it removed the malicious version, blocked further distribution and shut down the entire VS Code extension Marketplace as a precaution. It audited access, says it found no other extensions had been tampered with, rotated its keys and rebuilt the marketplace before bringing it back online. The company also worked with the server’s hosting provider to take that server offline, disrupting the tunnel and the data-reporting connection.
The marketplace shutdown addressed further distribution, but it does not clean machines that already ran the extension. Cursor specifically warns that uninstalling the extension may not remove standalone persistence scripts. Its notice directs affected users to search for the svc-telemetry key, investigate endpoint, network and extension-installation records, isolate machines showing signs of execution, remove the unauthorized key and persistence mechanisms, and rotate credentials and sessions from a trusted system.
The exposure is tied to one marketplace package
Cursor’s guidance makes the distinction between where the extension came from and what its name claimed: the incident involved versions 2.1.312 and 2.1.313 delivered through Cursor’s marketplace, not a finding that Anthropic’s official distribution was compromised. The company says the malicious server no longer functions, but advises users who installed or updated to either version during the October 29 window to follow its checks and remediation steps regardless.
The concrete warning sign Cursor identifies is the unauthorized SSH key marked svc-telemetry. Finding it means a machine is impacted, according to the company; removing the extension alone may leave the key and the scripts that attempt to restore the tunnel behind.