Tampered Claude Code extension in Cursor planted an SSH backdoor

Developers who use the Claude Code extension inside the Cursor editor should check their machines today. For about 11 hours on October 29, from 9:27 a.m. to 8:35 p.m. UTC, Cursor's extension marketplace offered a tampered version of the extension. According to Cursor's security notice, versions 2.1.312 and 2.1.313 for Windows and macOS are affected. Anyone with automatic updates turned on may have received the malicious build without doing anything.

What the tampered extension does

The extension looked and worked like the real one. A short loader was added in front of its code and runs as soon as the editor starts, so nobody has to open a Claude chat for it to trigger. It sends the hostname, username, operating system, configured Git email address and public IP address to a server run by the attackers. It also collects the names of environment variables that look like passwords or tokens. On top of that, it adds an SSH key labeled svc-telemetry and registers a LaunchAgent on macOS or a scheduled task on Windows.

Most of the time, the attack fell short. The extension needed administrator rights to open its remote SSH tunnel, and on most machines it did not have them. Cursor has since worked with the hosting provider to take the attackers' server offline. The system details were still sent, though, and the key and startup item stay on the machine until someone removes them.

Anthropic points to Cursor

Anthropic says its own systems were not compromised. Felix Rieseberg, who works on Anthropic's technical staff, wrote that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension," as reported by The Register. The versions on Microsoft's marketplace and Open VSX, as well as the npm package, are not affected. Neither Cursor nor Anthropic has said how the attacker gained access. Cursor puts the number of affected users at up to 5,000, according to The Hacker News, and plans to contact them directly. This is the third time in a week that attackers have used the Claude name, after fake download pages hosted on claude.ai and fake apps bundled with signed installers.

How to check your machine

Updating to the clean version 2.1.314 is not enough, because the startup scripts keep running on their own. Cursor describes a simple test. On a Mac, search the file ~/.ssh/authorized_keys for svc-telemetry in Terminal. On Windows, run the same search in PowerShell against the authorized_keys file in the .ssh folder of your user profile and against C:\ProgramData\ssh\administrators_authorized_keys. If the entry shows up, the machine is affected.

In that case, the machine needs a full cleanup. Cursor offers cleanup scripts for both systems that remove the extension, the key, the startup items and any running tunnels. After that, change every password, token and API key that could be reached from that machine, and do it from a different device you trust. Reinstalling the operating system is the safest option.