A fake Claude Code extension backdoored up to 5,000 Cursor users
A tampered build of the official VS Code extension sat in Cursor's marketplace for about eleven hours on 29 October, planting an SSH key and reverse tunnel on anyone who installed it.
Cursor disclosed on 29 October that a tampered build of Anthropic’s official Claude Code extension sat in its VS Code marketplace for about eleven hours, from 02:27 to 13:35 Pacific time. The build, version 2.1.313, reached Cursor’s store through Open VSX, the extension registry it mirrors. Anthropic says it did not produce that build, and Cursor found no evidence that the official Microsoft Marketplace listing or any other version was affected.
The planted code ran as soon as the extension loaded, with no Claude interaction needed. It added an attacker’s SSH key to authorized_keys, opened a reverse tunnel to a remote server, and set up persistence through a macOS LaunchAgent or a Windows scheduled task that retried roughly every sixty seconds. It also sent out hostname, username, OS, home directory, environment variable names and public IP over HTTP. Cursor says at most 5,000 users installed the bad build and is contacting them directly. A clean 2.1.314 is now live on Open VSX.
Why it matters: if you installed this extension through Cursor on 29 October, uninstalling it does not remove the backdoor. Check for the attacker’s SSH key, whose comment is svc-telemetry, run Cursor’s published cleanup scripts, and rotate any credentials on that machine from a separate, clean device.
The caveat: this hit Cursor’s marketplace and Open VSX, not the Microsoft VS Code Marketplace, which pulls from a different source and was not affected.