Developers who installed the Claude Code extension from Cursor’s marketplace on October 29 may have received a tampered copy. The package carried a malicious loader designed to install a persistent SSH backdoor, according to BleepingComputer, BankInfoSecurity and Ars Technica.
What happened. BleepingComputer reports that a malicious version, 2.1.313, of the Claude Code extension for VS Code-compatible editors was available on Cursor’s extension marketplace from about 2:27am to 1:35pm Pacific Time on October 29, roughly 11 hours. Ars Technica’s headline says nearly 12 hours, so the reported window differs slightly. Up to 5,000 developers may have been exposed, according to BleepingComputer. Another report also lists version 2.1.312 as affected.
What the malware tried to do. Researchers at Phorion and OpenSourceMalware found a malicious JavaScript loader at the start of the extension’s main file, with the rest of the code unchanged. It ran automatically when the extension loaded. It collected system details such as the Git email and public IP address, added an attacker-controlled SSH key, tried to enable SSH and open a reverse tunnel, and set up persistence through a macOS LaunchAgent or a Windows scheduled task. It also sent host details to an attacker-controlled server.
Why it may have largely failed. According to BleepingComputer, mistakes in the code meant the backdoor probably did not work as intended. On macOS, a check ran without the needed privileges and returned an error, so SSH was never switched on. On Windows, the script called a shell that is not present on standard installs. Even so, the loader could still install keys, persist and send back reconnaissance data, including usernames, hostnames, public IP addresses and names of environment variables related to credentials. The script did not directly steal credentials.
What Cursor did. Cursor removed the extension and temporarily shut down its entire marketplace to audit other extensions and rotate access keys before reopening it. It also worked with the hosting provider to take the attacker’s server offline. Cursor says it found no evidence that other extension versions or the official distribution were affected, and researchers said the official VS Code marketplace and Open VSX were not affected.
What is still unknown. Cursor says Anthropic did not develop the malicious extension, but it has not explained how attackers published a package under Anthropic’s name on its marketplace. It is also unclear whether Cursor’s or Anthropic’s systems were compromised. BleepingComputer contacted both companies, and its article reports no Anthropic response. Early reports that other distribution channels were hit were later not confirmed.
What developers should do. BleepingComputer’s advice is to check whether the package was downloaded during the exposure window and to look for an SSH key named svc-telemetry on machines. Where an impact is confirmed, follow Cursor’s remediation steps: isolate the machine, rotate any secrets it could reach, invalidate sessions and rebuild the environment from safe backups. One security researcher cautioned that SSH access can persist after the extension is removed, so each affected machine needs manual cleanup.
Why it matters. Editor extensions run with the same access as the developer, so a poisoned update can reach source code, keys and cloud accounts. The incident is a reminder that marketplaces for AI coding tools are now targets, and that teams should limit auto-updates for extensions on machines with sensitive access.
Sources: BleepingComputer, BankInfoSecurity and Ars Technica (headline). Details are as reported by those outlets and by Cursor.
Programming code on a screen (representative image), Wikimedia Commons, CC BY-SA 4.0
