Backdoor in Claude Code extension hit Cursor marketplace for 11 hours

A version of the anthropic.claude-code extension containing malicious code was briefly offered to users of the Cursor code editor. The malicious version was 2.1.313. According to StepSecurity, Anthropic has confirmed that it was never published on Open VSX or the Microsoft Marketplace, and that the malicious build existed only on Cursor's marketplace.

Up to 5,000 Cursor users may have received the malicious version. That is a maximum, and it is not known how many were actually affected.

How it unfolded

The clean version 2.1.312 was released on October 27. According to StepSecurity, the malicious version went live on October 29 at about 9:27 a.m. UTC. At about 8:35 p.m. UTC, Cursor removed the version and took its marketplace offline. That gives a window of about 11 hours.

On October 30 at 1:07 a.m. UTC, a clean version 2.1.314 was released. Version 2.1.313 was removed from the registries, and the attacker's command server was taken down.

According to StepSecurity, Anthropic states that "this was not a compromise of Anthropic's systems." Anthropic says, according to StepSecurity, that this was an unauthorized publication to Cursor's marketplace. ThreatDefence, however, calls it unresolved whether Anthropic's official channels were unaffected. Cursor has confirmed that the trojanized version was distributed through its marketplace and has made scripts available to help with cleanup.

What the code does

The code plants an attacker key named svc-telemetry in the SSH file authorized_keys. With it, the attacker can log in to the machine without a password. The code also ensures that the access survives a restart and adapts to the operating system. In addition, it opens a reverse SSH tunnel to the IP address 134.209.82.225 and sends information about the computer to the attacker's server.

According to StepSecurity, the release affected macOS, Windows and Linux. The security firm ThreatDefence describes only the variant for Apple silicon Macs. There, the code turns on Remote Login, sends data including the computer name, username, Git email and names of environment variables, and uses a LaunchAgent disguised as com.apple.sysmond. Uninstalling the extension does not remove the backdoor.

What you should do

According to Cursor, the exposure covers users who installed 2.1.312 or 2.1.313 from Cursor's marketplace during the window, and the malicious 2.1.312 existed only on Cursor's marketplace. ThreatDefence names Windsurf and VSCodium among the editors that use Open VSX, but 2.1.313 was not published there. ThreatDefence writes that Microsoft Visual Studio Code uses the official Marketplace and is not affected, and that no compromise has been reported there.

StepSecurity recommends checking authorized_keys for svc-telemetry, removing persistence files (LaunchAgents, scheduled tasks, cron), reinstalling version 2.1.314 or later, changing any accessible passwords and keys, and reviewing SSH logs. The address 134.209.82.225 should be blocked on ports 22 and 8099. ThreatDefence recommends isolating and rebuilding affected Macs.

It is unclear how the attacker gained access to publish on the marketplace. Both sources are security firms, and the statements from Anthropic and Cursor are relayed via StepSecurity.