Cursor Warns Uninstalling the Tampered Claude Code Extension Is Not Enough
A modified version 2.1.313 ran in Cursor's marketplace for about eleven hours on October 29, and Cursor says its persistence scripts keep running after the extension is removed.
Cursor said on Friday, October 30, that a maliciously modified version of Anthropic’s Claude Code extension, 2.1.313, sat in its extension marketplace for about eleven hours on Thursday, and that at most 5,000 users were affected.
The code gathered details about each machine and tried to open a hidden SSH route into it.
Cursor pulled the version, shut its marketplace as a precaution and rebuilt it. The IPO-bound Anthropic did not immediately respond to Reuters.
Backdoor Failed Without Administrator Rights but Left Persistence Behind
According to Cursor’s security notice, the modified extension.js file harvested machine details, including hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email, and public IP.
It then attempted to install an attacker-controlled key into authorized_keys, enable local SSH, and establish a reverse tunnel.
However, enabling SSH requires administrator privileges that Cursor lacks on standard macOS and Windows systems, preventing the attacker from logging in on those devices.
Despite this failure, the payload still saved the SSH key, installed persistent startup scripts (a macOS LaunchAgent or a Windows Scheduled Task), and sent host data to the attacker’s server.
The SpaceX-owned startup noted that while environment variable harvesting was limited, a secondary risk of credential theft via the backdoor remains.
A Check for the svc-telemetry Key
Only users who installed or updated to version 2.1.313 on October 29 are affected.
To check, search for an authorized SSH key labeled svc-telemetry: run a grep search on macOS in authorized_keys, or use the official PowerShell script on Windows to check user and ProgramData admin files.
If found, Cursor advises isolating the system, running its remediation script, and rotating all accessible credentials from a clean machine.
Simply deleting the extension is insufficient, as background persistence scripts retry the tunnel roughly every 60 seconds.
The macOS cleanup script runs under standard user permissions, while Windows requires an elevated Administrator PowerShell session. Both scripts exit with an error if malicious files remain.
Cursor says will notify impacted users directly.
Nobody Explained How the Build Got There
Reuters says it is not stated how the modified extension was uploaded.
The researchers disagree on the route: StepSecurity says the build appeared on Open VSX, which Cursor’s marketplace mirrors, while OpenSourceMalware’s update says Cursor told it the build sat in Cursor’s own marketplace instead.
StepSecurity says evidence indicates Microsoft’s marketplace listing was unaffected.
Until Cursor or Anthropic explains the upload, the only firm statement on origin is Cursor’s that Anthropic did not write the build, a critical distinction following previous incidents like Anthropic’s Claude Code source code leak.
Cursor’s response went past deleting one file: it audited access, rotated its own keys, rebuilt the marketplace and had the attacker’s server taken offline.
Source: Malicious version of Anthropic.claude-code identified in the Cursor Extension Marketplace
