Cursor Says a Backdoored Claude Code Extension Reached Up to 5,000 Users in 11 Hours

TL;DR

A trojanized build of the Claude Code editor extension, version 2.1.313 under the legitimate anthropic.claude-code ID, was served by Cursor's extension marketplace from about 2:27am to 1:35pm PT on October 29 (09:27 to 20:35 UTC). Cursor's security notice says at most 5,000 users installed it and that "this malicious version of the extension was not developed by Anthropic." A 66-line loader runs as soon as the extension module loads. It adds an attacker key to ~/.ssh/authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, installs persistence, and beacons host details plus the names of your secret-looking environment variables. Uninstalling the extension does not remove it. How the build got published under Anthropic's identity has not been established, and we found no public statement from Anthropic at the time of writing.

What happened

Cursor, which is built on VS Code, runs its own extension marketplace. On the morning of October 29 (Pacific time), that marketplace started offering Claude Code extension version 2.1.313. It looked like a routine update: same publisher, same extension ID, and the bundled Claude binary matched the normal release. OpenSourceMalware found that only extension.js differed, with a malicious loader prepended before the legitimate code.

Cursor pulled the version at 1:35pm PT, then took the whole marketplace offline. According to its notice, it audited access, found no other tampered extensions, rotated its keys, rebuilt and relaunched the marketplace, and got the hosting provider to take the attacker's server down. Cursor says it will contact affected users directly.

Anyone with auto-update on in that window could have received the build without doing anything. Cursor's figure of "at most 5,000 users" is an upper bound; it has not said how many machines actually ran the payload.

What the loader does

The injected code is an immediately invoked function at the top of the bundle. Phorion and StepSecurity both note that it needs no VS Code API and no user action: Node loading the file is enough, so you never had to start a Claude conversation for it to run.

From the three independent write-ups, the payload works in four steps:

• SSH key. Appends an attacker Ed25519 key with the comment svc-telemetry to ~/.ssh/authorized_keys.
• Reverse tunnel. Runs ssh -N -R (or autossh) out to 134.209.82.225 as user tunnel on port 22, which exposes your local SSH daemon to the operator through their server. It also tries to turn on remote login (systemsetup -setremotelogin on on macOS, OpenSSH Server on Windows).
• Persistence. A LaunchAgent named com.apple.sysmond.plist running ~/.config/.smt on macOS, @reboot cron entries on Linux and macOS, and a SysMon scheduled task plus a Startup-folder sysmon.cmd on Windows.
• Beacon. A plaintext HTTP POST to 134.209.82.225:8099/beacon with hostname, username, OS, architecture, home and working directories, global Git email, public IP, and the names of up to 40 environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP.

What it did not do (yet)

The beacon sends variable names, not values. Researcher Paul McCarty told The Hacker News that "environment-variable values are not placed directly in the initial beacon." No follow-on payload had been observed as of the published analyses. That is less comforting than it sounds. The names are a shopping list, and the reverse tunnel plus an authorized key give the operator a way back in to collect the values whenever they like.

Think of it as a burglar who leaves your TV alone, makes a copy of your front-door key, and writes down which drawers say "passwords" on the label. Nothing is gone from the house yet, but you still change the locks.

The payload also has rough edges. Turning on the local SSH service needs admin rights, and Cursor says the SSH steps often fail without them. Phorion found a macOS bug where systemsetup -getremotelogin, run without admin, prints an error and exits 0, so the script never reaches its enable step. That can leave the inbound path broken, but the key, the tunnel attempt and the persistence still land. Cursor's advice: "Follow the remediation steps below regardless."

Where it came from is still open

None of the published sources explain how a build signed off as Anthropic's ended up in Cursor's marketplace. The reports also disagree on where the build first appeared:

• Cursor places it in the Cursor marketplace and does not mention Open VSX.
• OpenSourceMalware updated its post to say the origin is the Cursor marketplace, "not Open-VSX," and that the Open VSX and Microsoft extensions and the @anthropic-ai/claude-code npm package are not malicious. The Hacker News issued a matching correction.
• StepSecurity says the build went live on Open VSX and reached Cursor through mirror sync, and describes the Anthropic namespace there as published by an Anthropic employee's account since 2025.

We checked the registries directly. The Open VSX listing now goes from 2.1.312 (October 27, 20:26 UTC) straight to 2.1.314 (October 30, 01:07 UTC), and a request for 2.1.313 returns 404. The npm package also jumps from 2.1.312 to 2.1.314, and the GitHub releases page has no v2.1.313 tag. That fits a version number that was burned and skipped, but it cannot tell you whether 2.1.313 ever sat on Open VSX before being purged.

Anthropic shipped 2.1.314 to Open VSX and the Visual Studio Marketplace on October 30. Its release notes for that version cover gateway routing and permission features and say nothing about the incident. For a tool whose job is to run shell commands on developer machines, silence from the publisher is a strange look.

Check your machine

If you use Cursor with the Claude Code extension, check even if you think you skipped the update. Cursor's notice uses the SSH key as the deciding test: if the key is present, the machine is affected.

# macOS / Linux
grep svc-telemetry ~/.ssh/authorized_keys
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null
crontab -l | grep @reboot
ls ~/.cursor/extensions | grep claude-code

# Windows (PowerShell)
schtasks /query /tn SysMon
Select-String svc-telemetry $env:USERPROFILE\.ssh\authorized_keys

If anything hits:

• Isolate the host and look for ssh or autossh processes talking to 134.209.82.225, plus the retry loop under /bin/sh.
• Run Cursor's remediation script from the notice: bash as the affected user (not root) on macOS, PowerShell as Administrator on Windows. Removing the extension alone leaves the backdoor in place.
• Rotate every credential whose variable name matches the filter, from a different, trusted machine. The attacker has the list.
• Consider a rebuild. Cursor tells affected users to assess whether the host should be rebuilt, since the tunnel could have been used for anything while it was up.

Why this one stings

The build carried the real extension ID and the real publisher, and it arrived through an ordinary update. StepSecurity counts tens of millions of lifetime Open VSX downloads for this extension. Coding agent extensions run with your user's access to SSH keys and cloud credentials, and they update themselves.

Cursor runs its own marketplace, separate from Microsoft's, so a publisher's identity now has more than one front door to guard. Until someone explains how 2.1.313 got published, decide on purpose whether extension auto-update belongs on machines that hold production credentials.

Key Takeaways

• A trojanized anthropic.claude-code 2.1.313 was served by Cursor's marketplace from 09:27 to 20:35 UTC on October 29; Cursor says at most 5,000 users got it and that Anthropic did not build it.
• The 66-line loader runs on module load, adds an svc-telemetry SSH key, opens a reverse tunnel to 134.209.82.225, persists via LaunchAgent, cron or scheduled task, and beacons host details plus secret variable names.
• Uninstalling the extension does not remove the backdoor. Check authorized_keys, run Cursor's remediation script, and rotate credentials from a clean machine.
• How the build was published under Anthropic's identity is unknown, and reports conflict on whether it touched Open VSX. Open VSX, npm and GitHub all skip from 2.1.312 to 2.1.314 today.
• Anthropic had not published a statement we could find at the time of writing; Cursor rotated its keys, rebuilt its marketplace and got the C2 server taken offline.

Sources: Cursor security notice, OpenSourceMalware analysis, Phorion advisory, StepSecurity analysis, The Hacker News, Open VSX listing, Claude Code releases on GitHub, @anthropic-ai/claude-code on npm, Hacker News discussion