Modified Claude Code extension gave attackers a backdoor into developers' computers

A modified version of the extension for Anthropic's coding tool Claude Code was available on October 29 through Cursor's extension marketplace. It gave attackers a hidden backdoor into users' computers. That is according to two security firms, StepSecurity and OX Security, in separate analyses.

According to OX Security, Cursor has said that no more than 5,000 users were affected. That is a ceiling, not a confirmed number of victims.

Under the real name

The malicious version was 2.1.313 and was published under Anthropic's genuine extension ID, anthropic.claude-code. It was not a fake extension sitting alongside the real one. According to StepSecurity, it reached only Cursor's marketplace and not Open VSX or VS Code's own marketplace.

OX Security says the version was available from about 09:27 to 20:35 UTC, or roughly 11 hours. The affected builds were for macOS (darwin-arm64) and Windows (win32-x64). No vulnerability was exploited, and users did not have to do anything beyond installing or updating the extension.

What the malware did

According to OX Security, the malware first collected information about the computer: hostname, username, operating system, git configuration and public IP address. It then added an attacker key named svc-telemetry to the authorized_keys file and tried to open a reverse SSH tunnel to the server 134.209.82.225. This means the attacker could gain access to the machine from the outside.

StepSecurity also describes how the malware installed persistence, so access remains even if the extension is removed. On macOS this was done with a LaunchAgent, and on Windows with scheduled tasks. StepSecurity also mentions cron entries and configuration files, as well as host information being sent to the attacker's server over HTTP on port 8099. These details come from a single source.

Cleanup and advice

Cursor removed the version and took the marketplace offline on October 29 at about 20:35 UTC. A clean version, 2.1.314, was released on October 30 at about 01:07 UTC. The previous clean version was 2.1.312 from October 27.

According to OX Security, uninstalling the extension is not enough. StepSecurity recommends that users:

- check ~/.ssh/authorized_keys for the svc-telemetry key - remove persistence - isolate affected machines - reinstall version 2.1.314 or later - change all passwords and keys that can be reached from the machines

The sources do not say how the attacker got the modified version onto Cursor's marketplace. The information about Cursor's statement comes from the security firms' account of it.