Cursor says a maliciously modified version of Anthropic’s Claude Code extension was available in the Cursor extension marketplace on 29 October, between about 2:27 a.m. and 1:35 p.m. Pacific time. It was published as version 2.1.313 under the extension’s real identifier (anthropic.claude-code), not as a lookalike. Cursor says the build was not developed by Anthropic and that at most 5,000 users were affected; it plans to contact them directly. How the attacker got a malicious update into the marketplace has not been explained.
According to Cursor and the researchers at OpenSourceMalware, the extension’s main JavaScript file carried a 66-line loader ahead of the legitimate code. When the extension activated, the loader tried to add an attacker-controlled SSH key, labelled svc-telemetry, to the user’s authorized_keys file, turn on the local SSH service, open a reverse SSH tunnel to an attacker server, and install persistence (a LaunchAgent on macOS, a scheduled task on Windows; The Hacker News also lists a crontab entry). It also sent basic host details to the same server: hostname, username, operating system, home directory, configured Git email, public IP and the names (not values) of environment variables that look like keys or tokens. Cursor says enabling the SSH service needs administrator rights, so on most macOS and Windows machines that step would have failed and the attacker could not have logged in through the tunnel. The key, persistence and beacon would still have been installed, so Cursor asks everyone who installed the version to follow its clean-up steps. Cursor says it has worked with the hosting provider to take the attacker server offline.
Cursor removed the version, shut down and rebuilt its marketplace, and rotated its keys. OpenSourceMalware says the official npm package, the Open VSX extension and the Microsoft VS Code Marketplace extension are not malicious; Anthropic has since published version 2.1.314 to Open VSX and the VS Code Marketplace, according to The Hacker News.
How to check if you’re affected
Affected versions: only anthropic.claude-code 2.1.313, installed or auto-updated from the Cursor marketplace during the window above. Other versions and other marketplaces are not known to be affected.
Cursor’s check is to look for the attacker’s key in your SSH authorized keys file. On macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found"
On Windows, Cursor’s notice gives a PowerShell check that looks in $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. If the key is found, treat the machine as affected.
If it is, Cursor advises isolating the host, removing the unauthorized key, persistence and running tunnel processes with the remediation script for your platform (macOS and Windows scripts are in its notice), considering a rebuild, and rotating credentials and sessions from a trusted machine. Uninstalling the extension alone may not be enough, because the payload drops standalone persistence scripts. Cursor’s published scripts and indicators cover macOS and Windows; for other systems, use the indicators in the notice (the attacker IP and the svc-telemetry key) to search.