A Backdoored Claude Code Extension Sat on Cursor's Marketplace for 11 Hours, Exposing Up to 5,000 Developers

For about 11 hours on Thursday, developers using Cursor could receive a booby-trapped copy of Anthropic's own coding tool. Version 2.1.313 of the Claude Code extension carried a backdoor that tries to plant an attacker's SSH key and open a reverse tunnel into the machine. It was posted under Anthropic's official account, and extensions in Cursor update automatically by default.

Cursor says the malicious version affected at most 5,000 users. The window ran from about 2:27 am to 1:35 pm Pacific on October 29. Nobody has explained how the attackers got to publish under that name.

"It was a supply-chain compromise where the attacker gained access to the official distribution channel," Phorion CTO Luke Roberts told Ars Technica. The bad release superseded version 2.1.312. Cursor says Anthropic did not develop it.

Running before anyone typed a prompt

The attackers added a malicious JavaScript loader to the start of extension.js and left the legitimate code untouched. It runs when the extension loads, so a victim never has to interact with Claude Code. It works on Windows, macOS and Linux, and because extensions run with the IDE's permissions, it could reach local files, source code and developer tooling.

Once running, it collects the hostname, username, operating system, public IP address, Git email and the names of environment variables, though not their values. Those names are still useful. Phorion says they let the operator take inventory of cloud credentials and API tokens and pick which victims to pursue next.

The malware then adds an SSH key named svc-telemetry, tries to enable SSH and opens a reverse tunnel. It persists through a macOS LaunchAgent or a Windows scheduled task or Startup script, retrying about every 60 seconds, and it beacons to an attacker server.

Sloppy, but still dangerous

The code has bugs that blunted the worst of it. On macOS, it checks Remote Login without privileges, gets an error and skips enabling SSH. On Windows, it tries to start OpenSSH through /bin/sh, which does not exist there. So on many Windows and Mac machines, the tunnel could not give access unless SSH was already running.

Persistence and reconnaissance still worked. Phorion's assessment is that "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator."

Cursor removed the version, worked with the hosting provider to take the attacker's server offline, and temporarily shut its entire marketplace to rotate keys, audit access and check other extensions. The marketplace is open again, and Cursor says it found no other affected versions. Anthropic pushed a clean 2.1.314 several hours later, researcher Kevin Beaumont said. Early reports claimed npm, Open VSX and Microsoft's marketplace were hit too, but Cursor was later confirmed as the only source.

The clean update is not a cure

Updating does not remove an existing infection. Anyone who installed or updated the extension from Cursor during that window should check for the svc-telemetry key and isolate the machine, then rotate any secrets it could reach, invalidate sessions and rebuild from safe backups.

AI coding tools keep turning into fresh attack surface. Days ago, we covered how a single AGENTS.md file in a downloads folder could turn Codex and Claude Code against their users.

The central question is still open: whether Cursor's systems or Anthropic's were compromised. Neither company answered questions from Ars or BleepingComputer, and Ars noted that Anthropic had yet to issue a public notice to its customers.

Some offers on this page may be paid placements or contain affiliate links.