Cursor marketplace served a tampered Claude Code 2.1.313 extension with an SSH backdoor, affecting at most 5,000 users
Cursor posted a security notice on X at 07:46 UTC on Oct 30: version 2.1.313 of Anthropic.claude-code in its VS Code extension marketplace was a maliciously modified build, not developed by Anthropic, available from about 2:27am to 1:35pm PT on Oct 29 and affecting at most 5,000 users. The payload collects host details, adds an attacker SSH key, tries to open a reverse SSH tunnel and installs persistence. Cursor pulled the version, shut down and rebuilt the marketplace, rotated keys and had the attacker server taken offline; it asks users to update Claude Code for VS Code to 2.1.314 and follow the check and cleanup steps in its blog post.
Key Takeaways
- Scope: Anthropic.claude-code 2.1.313 (darwin-arm64 and win32-x64 packages) in the Cursor extension marketplace, downloadable from about 2:27am to 1:35pm PT on Oct 29 (about 11 hours), at most 5,000 users
- Payload: collects hostname, username, OS, environment variable names, Git email and public IP; adds an attacker SSH key labeled svc-telemetry; tries a reverse SSH tunnel, retrying about every 60 seconds; reports to /beacon on port 8099
- Cursor says enabling the local SSH service needs admin rights, so that step fails on most macOS and Windows hosts, but the key, persistence and beacon still run; the attacker server is now offline
- Cursor pulled the version, shut down and rebuilt the marketplace, rotated keys and confirmed no other extensions were tampered with; it has no evidence other versions or Anthropic's official distribution were affected
- Self-check: on macOS run grep svc-telemetry ~/.ssh/authorized_keys; if found, isolate the host, run Cursor's remediation script, rotate credentials from a trusted machine, and update to 2.1.314
Linked Models & Agents:
