For roughly eleven hours on October 29, a tampered build of the Claude Code extension sat in Cursor’s extension marketplace: Anthropic.claude-code, versions 2.1.312 and 2.1.313, for Windows and macOS. Cursor puts the window at about 2:27 a.m. to 1:35 p.m. Pacific Time. BleepingComputer estimates up to 5,000 developers pulled the package while it was live.
Anthropic did not build it. How the attackers got a package published under Anthropic’s name into the marketplace is something Cursor has not explained.
What the payload did
Researchers at Phorion and OpenSourceMalware described the construction: an extra JavaScript loader prepended to extension.js, with the legitimate extension code left alone. The loader runs the moment the extension loads. Nobody has to touch Claude Code at all.
It collected and shipped out the hostname, username, operating system, architecture, home directory path, the names of environment variables, working directories, the Git email address on the machine and the public IP. Then came the actual point: an attacker-controlled key labeled svc-telemetry added to authorized_keys, the local SSH service switched on, a reverse tunnel opened outbound. Persistence went in through a LaunchAgent on macOS and a scheduled task running as SYSTEM on Windows, with a startup script as a fallback. A background script retried the tunnel roughly once a minute.
Two mistakes kept it small
On most machines the tunnel never opened, and that comes down to sloppy work. On macOS the payload checks whether Remote Login is running with systemsetup -getremotelogin, but runs it without elevation. What comes back is not a status but a privileges error. Since the script only switches SSH on when the answer reads “Off”, it skips the step. On Windows it tries to start the OpenSSH server through PowerShell but invokes it via /bin/sh, which a standard Windows install does not have.
The key, the persistence and the reconnaissance worked anyway. Cursor pulled the extension immediately, then shut down the entire marketplace, audited every other extension, rotated its keys and rebuilt the marketplace. The attacker’s server at 134.209.82.225 is off the network, taken down together with its hosting provider. Cursor’s audit found no sign that the official distribution channel was touched.
Uninstalling is not enough
If you installed or updated the package inside that window, start by looking for the svc-telemetry key in your authorized SSH keys. Removing the extension does not finish the job: the payload drops standalone scripts that keep running. Credentials and sessions reachable from that machine should be rotated from a system you trust.
The marketplace is the weak point, not the extension
Two days after the Embrace flaw in embedded browsers, the problem again is not the tool but the path the tool takes onto the disk. An extension marketplace ships code that executes on load, under a vendor name nobody can verify. That this particular attack died on a wrong shell path was luck.
Sources
- Cursor: Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor Extension Marketplace
- BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors
- Phorion: Official Claude Code Extension Compromise — Security Advisory
- DoublePulsar: Anthropic hacked via Cursor to deliver remote access trojan to Claude developer laptops worldwide