For 11 Hours, a Tampered Claude Code Extension in Cursor's Marketplace Tried to Plant an SSH Backdoor on Developers' Machines. Here Is How to Check

A maliciously modified version of Anthropic's Claude Code extension was available for about 11 hours on Oct. 29 in the extension marketplace run by Cursor, the AI coding company, and attempted to install a persistent backdoor on developers' computers, according to a security notice Cursor published that day and updated Oct. 30.

The affected packages were Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS, available between about 2:27 a.m. and 1:35 p.m. Pacific time, Cursor said. "These malicious versions of the extension were not developed by Anthropic," the notice says. Cursor said the incident did not affect other extensions in its marketplace.

Security firm Socket and other researchers reported that the tampered package was served through Cursor's marketplace rather than the separate Open VSX registry, which has no record of a 2.1.313 publication. Socket and StepSecurity both published technical analyses describing the payload as an SSH backdoor.

According to Cursor, the extension collected and reported host and user information, including hostname, username, operating system, home directory path, environment variable names, working directories, the configured Git email and public IP address.

It then attempted to add an attacker-controlled SSH key to the user's authorized_keys file, enable the local SSH service and open a reverse SSH tunnel to an attacker server, Cursor said. It tried to make the tunnel persistent through a LaunchAgent on macOS or a scheduled task on Windows, with background scripts retrying about every 60 seconds.

Cursor said errors in the malicious code, and the fact that enabling SSH requires administrator rights the extension does not have on most machines, meant the tunnel step would usually fail "outside of highly unusual circumstances where Cursor was started with administrator privileges." But the extension did add the attacker's key, install persistence and send host details. "Follow the remediation steps below regardless," the company wrote.

Cursor said it removed the malicious version when it was detected, then shut down the marketplace entirely as a precaution. It audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace and brought it back online, and worked with the cloud provider hosting the attacker's server to take it offline. "The attacker server no longer functions," the notice says.

Cursor did not say publicly how the attacker was able to publish the modified package or how many users installed it.

The malicious extension appends a public key labeled svc-telemetry to the SSH authorized keys file. Cursor's notice gives a one-line check for macOS: searching ~/.ssh/authorized_keys for the string svc-telemetry. On Windows, the notice gives a PowerShell command that checks both the user's authorized_keys file and C:\ProgramData\ssh\administrators_authorized_keys. The key's fingerprint is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, according to the notice.

If the key is present, the machine is affected. Cursor recommends isolating it, removing the unauthorized key, persistence mechanisms and tunnel processes, and assessing whether the machine should be rebuilt. "Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running," the notice says. It also advises rotating credentials and sessions that were accessible from the affected host, from a trusted system.

Cursor published remediation scripts for macOS and Windows and a list of indicators, including the attacker IP address 134.209.82.225, a macOS LaunchAgent named com.apple.sysmond, and a Windows scheduled task named SysMon.

Developer tools sit close to source code, credentials and cloud accounts, which makes extension marketplaces an attractive target. An extension carrying a trusted name can run code with the same permissions as the editor. In this case, the attack used the name of a widely used AI coding assistant.

Anyone who installed or updated the Claude Code extension from Cursor's marketplace on macOS or Windows during the Oct. 29 window should run the check. Users who installed the extension from other sources, or on other dates, were not affected by this package, according to Cursor, which said it has no evidence that other versions or the official distribution were compromised. Questions can go to [email protected].