Trojanized Claude Code Extension Hits Up to 5,000 Cursor Users
3 min readA tampered build of Anthropic’s Claude Code extension sat on the Cursor Marketplace for about eleven hours on October 29, and any Cursor user whose editor pulled the update got a persistent SSH backdoor with it. Cursor says at most 5,000 users are affected. Anthropic says its own systems were never breached, Cursor has rotated its keys, and the attacker’s command server is offline.
What the Claude Code extension incident looked like
The Claude Code extension is how developers run Anthropic’s coding agent inside VS Code and forks such as Cursor. Versions 2.1.312 and 2.1.313 appeared on the Cursor Marketplace under the legitimate anthropic.claude-code publisher identity between roughly 2:27 a.m. and 1:35 p.m. Pacific time, according to The Hacker News. Researchers at Phorion and OpenSourceMalware found a 66-line loader inserted ahead of the real extension code. On startup it adds an attacker key labeled svc-telemetry to the user’s authorized SSH keys, tries to turn on the SSH service on Windows, macOS and Linux, and opens a reverse tunnel to a remote server, with a scheduled task, crontab entry or LaunchAgent retrying it about every 60 seconds.
The loader also sent host details over plain HTTP: public IP address, hostname, username, operating system, home directory, the global Git email, and the names of up to 40 environment variables containing strings such as KEY, TOKEN, SECRET, AWS or GCP. It did not ship the values, but with SSH access an operator could read them directly. Open VSX and Microsoft’s VS Code Marketplace were not affected, and Anthropic has published a clean 2.1.314.
Anthropic and Cursor respond
Felix Rieseberg of Anthropic’s technical staff said the incident “wasn’t a compromise of Anthropic’s systems or employee laptops,” and that a malicious actor used access to Cursor’s marketplace to publish a copy Anthropic never built, The Register reported. Cursor said it removed the versions as soon as it detected them, took its marketplace offline out of caution, audited other extensions, rotated its own keys and had the hosting provider shut down the attacker’s server. Neither company has explained how the tampered package cleared the marketplace’s publishing checks.
Cursor also noted that enabling the SSH service needs admin rights the extension does not normally have, so the tunnel often failed. The data collection, the planted key and the persistence still happen, and installing the clean version does not remove them.
Why it matters
This is the latest in a run of supply chain hits on developer tooling, following the OVHcloud CLI binaries swapped for secret stealers around October 20 and a wave of malicious VS Code themes tied to the GlassWorm operation. AI coding agents are a tempting target because they run with broad access to source code, credentials and cloud accounts, and many users leave auto-update on.
If you installed the extension from Cursor on October 29, isolate the machine, remove the svc-telemetry key and any scheduled task, cron job or LaunchAgent you did not create, then rotate credentials and sessions. Expect marketplaces to tighten publisher verification after this one, and expect attackers to keep testing them.