A Tampered Claude Code Extension Planted SSH Backdoors on Cursor

On October 29, developers who updated Anthropic’s Claude Code extension inside Cursor got something Anthropic did not build. A tampered copy of the extension sat in Cursor’s marketplace for about 11 hours, from 2:27 a.m. to 1:35 p.m. Pacific time, and arrived as an ordinary update under the extension’s real name and publisher ID.

Cursor put the exposure at most 5,000 users. That is the company’s upper bound, not a count of confirmed infections. The company removed the build, shut down its entire marketplace for a time to audit other extensions and rotate access keys, and worked with a hosting provider to take the attacker’s server offline.

What the tampered build did

Researchers at OpenSourceMalware found a 66-line loader inserted in front of the legitimate code in the extension’s main JavaScript file. It ran when the extension loaded, so a user did not need to open a Claude chat for it to act.

First, it collected details about the machine: the hostname, username, operating system, architecture, home and working directories, and the global Git email. It also noted the names of up to 40 environment variables containing terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP. Microsoft’s analysis stresses that it collected the variable names, not their values.

Then it tried to plant a lasting way back in. It appended an attacker-controlled key, labeled svc-telemetry, to the user’s SSH authorized-keys file, tried to switch on the local SSH service, and opened a reverse tunnel that retried about every 60 seconds. It also wrote startup entries outside the extension folder: a LaunchAgent on macOS, a reboot entry in the user crontab on Linux, and a scheduled task on Windows. That last point matters for cleanup. Removing or updating the extension does not remove those artifacts.

Why it probably did not get all the way in

Turning on remote login needs administrator rights the extension did not have on most machines. Cursor reported that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts. Microsoft adds the same caution in general terms: whether remote access worked depended on host privileges, SSH configuration, and the attacker’s server settings.

That is not an all-clear. The key, the startup entries, and the host report could still land even where the tunnel failed. Microsoft and Cursor both tell anyone who installed or updated the extension in Cursor on October 29 to check for the svc-telemetry key and the startup entries, and to follow Cursor’s remediation steps rather than assuming an update fixed it. Where investigation shows the loader ran, Microsoft advises preserving evidence before cleanup, removing the exact unauthorized key and persistence entries, and rotating credentials or rebuilding the machine if trust in it cannot be restored.

What was not affected, and what is still unanswered

Anthropic told Microsoft its systems were not compromised and that it did not develop the malicious package. Microsoft confirmed the tampered builds were never published or distributed through its Visual Studio Marketplace or through the Claude Code npm package, and the clean version 2.1.314 was published on October 30. The affected builds were versions 2.1.312 and 2.1.313, distributed only through Cursor’s marketplace.

The open question is how the tampered build got published under Anthropic’s publisher identity in the first place. Cursor has not explained that part, and BleepingComputer reports the company did not answer when asked. Until it does, this incident is hard to file as a one-off bad listing. A careful developer could avoid a lookalike extension. This one came through the trusted update channel itself, wearing the right name.