A tampered version of Anthropic’s Claude Code extension was available in Cursor’s extension marketplace for over 11 hours yesterday. It attempted to install a persistent SSH backdoor. Up to 5,000 users were affected. Cursor took the marketplace completely offline as a precaution.
The affected version is 2.1.313 of the Anthropic.claude-code package. According to Cursor, Anthropic did not develop this version. The malicious package was available on October 29 in the US Code extension marketplace of the AI code editor. Cursor is contacting the affected users directly.
After the discovery, Cursor removed the version and blocked further distribution. Cursor then took the entire marketplace offline. The company verified access, rotated its keys, and rebuilt the marketplace before bringing it back online. According to Cursor, no other extensions were tampered with. No evidence has been found that other versions of the extension or the official distribution were affected.
Backdoor via reverse SSH tunnel
First, the code collected system information: hostname, username, operating system, the configured Git email address, environment variable names, and the public IP address. The extension then added an SSH key belonging to the attacker, labeled “svc-telemetry”, to the `authorized_keys` file. It then attempted to enable the local SSH service and open a reverse SSH tunnel to the attacker.
On macOS, a LaunchAgent was intended to make that tunnel persistent. On Windows, it used a scheduled task that attempts to run as SYSTEM, with a startup script as a fallback. Background scripts attempted to re-establish the connection approximately every 60 seconds.
However, actual access appears to be limited. Enabling SSH requires admin privileges, which the extension does not have on most macOS and Windows systems. Furthermore, the malicious code contained errors. That step could only succeed if Cursor was launched with administrator privileges. Cursor also took the attacker’s server offline in collaboration with the cloud provider.
However, adding the key, establishing persistence, and forwarding host data did work. Cursor warns that uninstalling the extension may not be enough, as the payload leaves behind standalone scripts that continue to run. Users can check whether the svc-telemetry key is present using a `grep` command on macOS or a PowerShell script on Windows. If it is found, Cursor recommends isolating the machine, running the remediation scripts, and rotating credentials and sessions from a trusted system. Administrators should also assess whether the system needs rebuilding.