Developers who use the Cursor code editor got a security warning that demands immediate attention this week. A trojanized version of Anthropic's Claude Code extension was distributed through Cursor's own extension marketplace as a routine update, and it tried to plant a persistent SSH backdoor on the machines that installed it. Cursor says at most 5,000 users received the malicious build during an exposure window of about eleven hours on October 29, from roughly 2:27 a.m. to 1:35 p.m. Pacific Time.
The attackers did not create a lookalike extension. They distributed the package under Anthropic's legitimate Claude Code extension identity, anthropic.claude-code, as version 2.1.313. According to OpenSourceMalware, whose analysis was shared with The Hacker News, the main JavaScript bundle contained a malicious 66-line loader inserted ahead of the legitimate code. The loader ran when the extension loaded, so no Claude conversation was needed for it to execute, and auto-update meant many developers received it without choosing anything.
Once running, the loader added an attacker-controlled SSH key, labelled svc-telemetry to look harmless, to the user's authorized_keys file. It then tried to enable the local SSH service, open a reverse SSH tunnel to an attacker server, and install persistence suited to each platform: a LaunchAgent on macOS, a scheduled task on Windows, and a crontab entry on Linux. It also sent host details to that server over unencrypted HTTP: hostname and username, operating system and architecture, home and working directories, Git email address, public IP address, and the names of up to 40 environment variables containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP. The values themselves were not included in that first beacon, researchers noted, but successful SSH access would have let the operator look around the account directly.
There is an important limit, though. Turning on the local SSH service requires administrator rights, which the extension lacked on most macOS and Windows hosts, Cursor said, so that step failed and the attacker could not have logged in through the tunnel. That is not the same as no harm done. The extension still wrote the attacker's key, installed its persistence, and sent the host details, which is why Cursor and Microsoft both urge affected users to follow the full remediation steps regardless: check for the svc-telemetry key, remove the persistence artifacts separately, and rotate credentials and sessions reachable from the machine. Simply uninstalling or updating the extension does not remove files written outside its own folder.
Both companies have stressed what was not compromised. Anthropic said its systems were not compromised, and that versions on its official channels, including VS Code and Open VSX, are not affected. Microsoft confirmed the malicious version was never published through the Visual Studio Marketplace or through npm. Anthropic's published releases move from 2.1.312 to a clean 2.1.314, with no official 2.1.313 in between. Cursor removed the package, temporarily shut down its marketplace, audited other extensions and found none tampered with, rotated its keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker's server offline.
What remains unanswered is how an attacker managed to publish a malicious build under Anthropic's name in Cursor's marketplace. Until that is explained, the lesson for development teams is plain: treat editor extensions as part of the supply chain, because they run with a developer's own access to repositories, cloud accounts and credentials, and audit what auto-update quietly delivers.