Fake Claude Code extension backdoored Cursor users

If you run Claude Code inside Cursor, check one file before you do anything else today.

Cursor says modified versions 2.1.312 and 2.1.313 of the Claude Code extension were served from its VS Code extension marketplace on Oct. 29 and tried to install an SSH backdoor on Windows and macOS machines.

Eleven hours on the shelf

According to Cursor's notice, the malicious versions were available from about 2:27am to 1:35pm Pacific time on Oct. 29. "These malicious versions of the extension were not developed by Anthropic," the notice says. The company says up to 5,000 users were affected, The Decoder reports.

Cursor lists what the code did. It collected the hostname, username, operating system, home directory, environment variable names, working directories, Git email and public IP address. It then tried to add an attacker's SSH key, turn on the local SSH service, open a reverse tunnel and make that tunnel survive a restart, through a LaunchAgent on macOS or a scheduled task called SysMon on Windows.

Cursor says turning on the SSH service needs administrator rights the extension usually lacks, so that step would typically fail unless Cursor was running with administrator privileges. It also says the attacker's server no longer works.

Cursor removed the versions, shut the whole marketplace down, rotated keys, rebuilt it and brought it back. It says it "audited access and confirmed no other extensions were tampered with." The notice does not say how the modified versions got uploaded.

The label said Anthropic. The shelf was Cursor's.

This is a supply chain attack in its plainest form. The attacker never had to touch Anthropic's code. They needed the store between the publisher and your laptop.

You trust a coding extension with your files, your terminal and often your keys. Most people check the publisher's name and stop there. That name was right. The file was not.

Credit where due: Cursor pulled it within a day and published hashes, file paths and an attacker IP that security teams can search for. That is how a notice should read.

Run these checks now

Cursor's notice gives the steps, and it warns that "Uninstalling the extension may not be sufficient." Start here:

1. Check whether you installed or updated to 2.1.312 or 2.1.313 on macOS or Windows during that window on Oct. 29.
2. Search your authorized_keys files for a key with the comment svc-telemetry.
3. If it is there, run Cursor's remediation script: remediate-macos.sh as your own user, not root, or remediate-windows.ps1 in an elevated PowerShell. Then rotate every credential and session that machine could reach, from a trusted system.

Cursor tells affected users to remediate regardless, because the key was added, persistence was installed and host details were sent, even where the attacker could not log in. Security teams can search for the endpoint 134[.]209[.]82[.]225 and the hashes in the notice.

If you manage a team, this is also the week to decide which extensions update automatically, and from where.

Watch for how it got in

The open question is the upload. Cursor has not said whose access was used or how. Until it does, treat every marketplace mirror as a place where a trusted name can carry an untrusted file.

Check the key. Then pin your extensions.