Backdoored Claude Code extension hit Cursor's marketplace

What happened

According to Cursor's security notice, a maliciously modified version of Anthropic's Claude Code extension was available in the Cursor VS Code Extension Marketplace on October 29 between roughly 2:27am and 1:35pm PT (Cursor). The affected versions are 2.1.312 and 2.1.313 for macOS and Windows. Cursor says they were not developed by Anthropic and that no other extensions were tampered with.

Security firm Phorion calls it a supply-chain compromise: the attacker gained access to the official distribution channel, and the malicious 2.1.313 was posted to the official Anthropic account (Phorion). Because extensions auto-update in Cursor by default, many users may have received it without doing anything.

What the malicious code did

• Collected host details: hostname, username, OS, home directory, environment variable names, configured Git email and public IP.
• Tried to add an attacker SSH key (labeled svc-telemetry) to authorized_keys, enable the local SSH service and open a reverse SSH tunnel.
• Installed persistence: a LaunchAgent on macOS and a scheduled task (SysMon) on Windows that retried the tunnel about every 60 seconds.

Cursor says enabling the SSH service needs admin rights, so on most machines that step failed and the attacker could not log in through the tunnel. The key, the persistence and the host beacon did go through. Phorion notes that the environment variable names let the operator quickly map which machines held cloud credentials and API tokens. Cursor worked with the hosting provider to take the attacker server offline, shut down the marketplace, rotated keys and brought it back after a rebuild.

What to do now

If you installed or updated the extension in Cursor during that window, search your authorized_keys for the svc-telemetry key. Cursor's notice includes check commands and remediation scripts for macOS and Windows. If the key is there, isolate the machine, remove the key and persistence, and rotate every credential reachable from it using a trusted system. Uninstalling the extension alone is not enough, because the dropped scripts keep running.

Ars Technica reports that Anthropic had not issued a public notice at the time, and neither company explained how the attacker reached the distribution channel (Ars Technica). The incident is a reminder that an auto-updating AI coding extension runs with the full permissions of your editor, so it carries the same supply-chain risk as any other dependency.