Malicious Claude Code Cursor Extension Planted SSH Backdoor

Cursor has pulled a tampered build of Anthropic’s Claude Code extension, version 2.1.313, after its own extension marketplace served it for 11 hours on October 29, and the code planted an attacker’s SSH key on the machines of up to 5,000 developers.

The malicious package carried the legitimate extension ID, anthropic.claude-code, so Cursor installed it as an ordinary update. Researchers found a 66-line loader prepended to the extension’s main JavaScript bundle that collected host details, added an SSH key labelled svc-telemetry, tried to open a reverse SSH tunnel to an attacker server, and installed persistence on macOS and Windows. The incident is a supply-chain compromise, not a software flaw, and has no CVE.

Cursor disclosed the incident in a security notice dated Thursday, October 29, saying the build was available between 2:27 a.m. and 1:35 p.m. PT (09:27 to 20:35 UTC, or 2:57 p.m. to 2:05 a.m. IST).

In a post on X , the company said it took its whole extension marketplace offline, reinstated it after confirming no further risk, and asked customers to update to Claude Code for VS Code version 2.1.314.

As of October 30, version 2.1.313 is not listed on Open VSX, Microsoft’s Visual Studio Marketplace, or npm; the attacker’s server is offline, and Cursor says it will affected users directly. Anthropic has not commented publicly on the incident.

What the Malicious Claude Code 2.1.313 Build Did

The trojanized Claude Code extension ran its payload the moment the editor loaded it. Calum Hall, CEO of macOS security firm Phorion, said the injected code executes before the extension’s normal activate callback, adding that “the user doesn’t need to interact with the extension for the payload to fire.” Opening a Claude chat was not required.

The loader first profiled the machine. According to Cursor, it gathered the hostname, username, operating system, CPU architecture, and working directories, the global Git email and the public IP address.

Researcher Paul McCarty of OpenSourceMalware said that it also collected the names of up to 40 environment variables containing strings such as KEY, TOKEN, SECRET, PASS, AWS, or GCP. The values were not sent, but the names tell the operator which machines hold cloud and API credentials.

The payload then appended an Ed25519 public key with the svc-telemetry to the user’s authorized_keys file, tried to switch on the local SSH server, and opened a reverse SSH tunnel to [email protected] [.]225 on TCP port 22 using a private key embedded in the extension. A reverse tunnel lets the attacker reach the victim’s SSH service from outside even when the machine sits behind a firewall or NAT. Background scripts retried the tunnel roughly every 60 seconds.

For persistence, the Claude Code payload installed a LaunchAgent named com.apple.sysmond on macOS and, on Windows, a scheduled task called SysMon that tries to run as SYSTEM, with a sysmon.cmd script in the Startup folder as a fallback.

Researchers report a Linux code path that adds a cron entry at reboot, but Cursor’s notice names only the darwin-arm64 and win32-x64 builds. Host details and backdoor status went to the attacker in an unencrypted HTTP POST to port 8099.

Why the SSH Backdoor Mostly Failed

Bugs in the malicious code blunted the attack. Cursor says turning on the SSH service requires administrator rights the extension does not have on most macOS and Windows machines, so the step fails, and the attacker could not log in through the tunnel unless Cursor had been started with admin privileges.

Phorion traced the macOS failure to a faulty check: the script asks whether Remote Login is off without admin rights, receives an error, and skips the step that would enable SSH. Hall warned that the bug is no defence on a Mac where Remote Login is already enabled, or where the user enables it later, because the planted key and persistent tunnel are then ready to use.

Even where the login step failed, Cursor says the extension still added the attacker’s key, installed persistence, and sent host details. Cursor worked with the cloud provider hosting 134.209.82[.]225 to take the server offline, so the tunnel and the beacon no longer function.

How the Fake Claude Code Update Reached Cursor Is Unexplained

Cursor has not said how the attacker got the package into its marketplace or who is behind it. The company says it removed the build on detection, shut down the full marketplace as a precaution, audited access, found no other tampered extensions, rotated its keys, and rebuilt the marketplace before bringing it back online.

The first public reports from OpenSourceMalware and Phorion placed the malicious build on Open VSX, the Eclipse Foundation registry that Cursor, Windsurf and VSCodium use instead of Microsoft’s store, and StepSecurity described Cursor’s marketplace as a mirror of it.

Socket disputed that account after reviewing 3,392 events in Open VSX’s append-only change feed between October 27 and 05:35 UTC on October 30. The feed recorded all eight platform builds of versions 2.1.312 and 2.1.314, but no publication or removal event for 2.1.313, even though 42 short-lived versions of 21 other extensions in the same period left both records.

Socket also found no 2.1.313 entry in npm’s publication history for @anthropic-ai/claude-code, where 2.1.312 appeared on October 27 and 2.1.314 at 00:12 UTC on October 30. OpenSourceMalware has since revised its post to name the Cursor Marketplace as the source and to state that the Open VSX build, Microsoft’s VS Code extension, and the npm package are not malicious.

Cursor says it has no evidence that other versions of the Claude Code extension or Anthropic’s official distribution were affected. Anthropic’s GitHub releases and changelog skip 2.1.313 without explanation, as of October 30.

How to Check for the svc-telemetry Backdoor

Cursor users who installed or auto-updated to Anthropic.claude-code 2.1.313 from the Cursor marketplace during the October 29 window should check for the attacker’s key. Cursor’s one-line test for macOS:

On Windows, Cursor’s PowerShell check also covers the administrators’ key file used by OpenSSH:

Security teams can also sweep installed extensions: the extension.js file inside an anthropic.claude-code-2.1.313-darwin-arm64 or anthropic.claude-code-2.1.313-win32-x64 folder contains the strings 134.209.82[.]225 and svc-telemetry. Phorion suggests checking SSH logs for logins from localhost that used the svc-telemetry key, which would show whether an operator actually came through the tunnel.

What Affected Cursor Users Should Do Now

Uninstalling the Claude Code extension is not enough, because the payload drops standalone persistence scripts that keep running. Cursor has published remediate-macos.sh , which must be run as the affected user and not as root, and remediate-windows.ps1 , which must be run from an elevated PowerShell window. Both remove the extension, the persistence entries, running tunnel processes and the attacker’s key, and exit with a non-zero status if anything remains.

Cursor tells organisations to endpoint, network and extension-installation telemetry for the indicators, isolate any host showing signs of payload execution, and decide whether to rebuild it. Credentials and sessions reachable from an affected machine should be rotated from a trusted system, since Cursor says the limited environment-variable collection does not rule out later credential theft over the backdoor. After cleanup, update the extension to 2.1.314.

Cursor’s file indicators on macOS are ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_ followed by 10 hex characters, and ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows they are %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_ files, the SysMon scheduled task and %APPDATA%\Microsoft\Windows\Start \Programs\Startup\sysmon.cmd.

The attacker key’s fingerprint is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, and the reverse-tunnel key’s fingerprint is SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ. Running processes to look for include ssh -N -R ‘*:0:localhost:22’ and autossh -M 0 with StrictHostKeyChecking=no. The modified VSIX packages hash to 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 (macOS arm64) and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 (Windows x64).

Cursor also lists outbound SSH connections to 134.209.82[.]225 and HTTP POSTs to its /beacon endpoint on port 8099 as indicators; lookups to ifconfig.me or api.ipify.org are legitimate and not a sign of infection on their own.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!