Cursor marketplace served a tampered Claude Code 2.1.313 extension with an SSH backdoor, affecting at most 5,000 users

Background and pain point

AI coding tools increasingly depend on extension ecosystems. Cursor is built on VS Code, and users install popular extensions such as Claude Code from Cursor's own marketplace, where an extension runs with the same local permissions as the editor. At 07:46 UTC on Oct 30, Cursor disclosed on X and its blog that Anthropic.claude-code 2.1.313 in its marketplace was a maliciously modified build, not developed by Anthropic. It could be installed or auto-updated from about 2:27am to 1:35pm PT on Oct 29, and at most 5,000 users were affected; Cursor says it will contact them directly. It is one of the clearest supply-chain incidents in AI coding tools this year, because the attacker used a trusted, official-looking extension.

How the payload works

According to Cursor, the malicious extension.js collects hostname, username, OS and architecture, home path, environment variable names, working directories, Git email and public IP; appends an attacker public key labeled svc-telemetry to authorized_keys; tries to enable the local SSH service and open a reverse SSH tunnel, persisting through a LaunchAgent disguised as com.apple.sysmond on macOS or a SysMon scheduled task on Windows and retrying about every 60 seconds; and reports status to /beacon on port 8099. Cursor says enabling SSH needs admin rights, so on most hosts that step fails, also because of errors in the malicious code, and the attacker could not log in through the tunnel; the key, persistence and beacon still run. Cursor pulled the version, shut down the whole marketplace, audited it and found no other tampered extensions, rotated keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker server offline.

Benchmarks

This is a security incident, so there are no benchmarks. The verifiable figures are Cursor's own: at most 5,000 users, an exposure window of about 11 hours, tunnel retries about every 60 seconds, and beacon port 8099. The notice also lists SHA-256 hashes for both VSIX packages, the attacker IP and SSH key fingerprints for security teams. Cursor has not yet said how the malicious version got into its marketplace.

What developers should do

If you installed or updated the Claude Code extension from the Cursor marketplace in that window, check first: on macOS run grep -qs svc-telemetry ~/.ssh/authorized_keys, and on Windows check authorized_keys and administrators_authorized_keys in PowerShell. A match means the machine is affected. Isolate it, run Cursor's remediate-macos.sh as the normal user or remediate-windows.ps1 from an admin PowerShell, since uninstalling the extension alone leaves the persistence scripts running, then rotate credentials and sessions reachable from that host from a trusted machine and consider rebuilding it. Everyone should update Claude Code for VS Code to 2.1.314. Security teams should search EDR and network logs for the IP, file paths and process patterns in the notice.