TL;DR: A tampered build of Anthropic’s own Claude Code extension sat live in Cursor’s VS Code extension marketplace for about 11 hours on October 29, planting SSH backdoors and phoning home on developer machines before Cursor pulled it. Cursor says up to 5,000 users were affected, the attacker’s own server has since been taken offline, and most Mac and Windows installs were saved only because the malicious code lacked the admin rights it needed to finish the job.
Two bad versions, eleven hours, one marketplace
Cursor disclosed on October 29 that two versions of the Anthropic.claude-code extension, 2.1.312 and 2.1.313, were circulating through its own VS Code extension marketplace with code Anthropic never wrote. By Cursor’s own account the tainted builds were live from roughly 2:27 a.m. to 1:35 p.m. Pacific time that day, a window of about eleven hours. Cursor says it pulled the versions as soon as it caught them, blocked further distribution, and then shut the entire marketplace down out of caution while it audited every other extension on the shelf. Nothing else came back tampered, according to the company, and the marketplace is back online after a key rotation and rebuild.
Cursor has been blunt that it did not build this code and that Anthropic did not either. “These malicious versions of the extension were not developed by Anthropic,” the company wrote in its security notice, adding that the incident does not touch other extensions on its marketplace, Grok Bot, Grok, or its other products. Anthropic has not published a separate statement of its own beyond that line being echoed back by Cursor.
What the backdoor actually did once it loaded
The payload lived inside extension.js and ran the moment Node loaded the file, before the extension’s own activation code ever got a chance to fire. No click, no prompt, nothing for a developer to approve. According to Phorion, the macOS security firm that researchers there say first caught it, the injected code pulled in Node’s child_process, fs, os, path, http, and crypto modules and went straight to work.
First it did reconnaissance: hostname, username, operating system, architecture, home directory, working directory, the developer’s configured Git email, public IP address, and the names (not the contents) of up to 40 environment variables that looked like API keys, tokens, or cloud credentials. That last part matters more than it sounds. Phorion CEO Calum Hall described it as giving the attacker “an inventory” of exactly which machines were worth coming back for, even before stealing a single secret.
Then it tried to dig in. The code added an SSH key labeled svc-telemetry to the user’s authorized_keys file, attempted to switch on the local SSH service, and opened a reverse SSH tunnel back to a server at 134.209.82.225, with a beacon checking in on port 8099 roughly every 60 seconds. For persistence it dropped a LaunchAgent called com.apple.sysmond on macOS, a scheduled task named SysMon (with a Startup-folder script as backup) on Windows, and a cron entry set to run at reboot on Linux. Cursor has warned that uninstalling the extension alone will not remove any of this. The tunnel and the scripts keep running even after the editor closes.
Why most machines were spared the worst of it
Here is the one piece of real luck in this story. Enabling SSH remote login on most Mac and Windows machines requires administrator privileges, and the extension simply did not have them. Cursor says that is exactly why the reverse tunnel mostly failed to connect, outside unusual setups where the editor itself had been launched with elevated rights. Phorion agrees the attempt largely failed on stock installs, but Hall is careful not to call it a non-issue: if Remote Login was already turned on, or gets turned on later for any reason, the planted key is still sitting in authorized_keys waiting to be used. The recon beacon, the persistence mechanism, and the credential inventory all installed regardless of whether the SSH piece worked.
How Cursor is cleaning up
Beyond pulling the builds and rebuilding the marketplace, Cursor says it worked with the hosting provider behind the attacker’s server to take it offline, which stops the tunnel attempts and any further data reaching whoever ran this. The company has published two remediation scripts, one for macOS and one for Windows, along with a one-line check anyone can run themselves: searching an authorized_keys file for the string svc-telemetry. Finding it means the backdoor got installed, not necessarily that it got used, since that depends on whether SSH was reachable.
Cursor’s own advice is to treat a positive hit seriously: isolate the machine, remove the planted key and any scheduled task or cron entry, consider rebuilding the host outright rather than trusting a cleanup, and rotate every credential reachable from that machine, done from a different, trusted computer. Given that this is roughly the same supply-chain playbook that turned a backup plugin into a mass backdoor across more than three million WordPress sites when UpdraftPlus’s stolen connection keys got loose, that caution is well earned. A trusted distribution channel is still only as safe as whoever last had write access to it.
Why this one stings a bit more
Claude Code is not some obscure plugin. It is Anthropic’s own flagship entry into the increasingly crowded field of AI coding tools, the same category where GitHub has been pushing hard with its new Copilot Fusion model router. Developers install these extensions precisely because they are supposed to be the trusted, official thing, often with deep access to a codebase, cloud credentials, and SSH keys already sitting on the machine. That is exactly what makes an extension marketplace such a tempting target: compromise the right package for a few hours and you are not phishing one developer, you are potentially reaching thousands who did nothing wrong except trust the name on the label.
No affected-user count has been independently verified beyond Cursor’s own “up to 5,000” figure, and nobody involved has named who was behind it. Cursor has not said how the malicious versions got published in the first place, whether that was a compromised publishing account, a supply-chain weakness further upstream, or something else. That gap is worth watching for a follow-up disclosure.
The bottom line
Eleven hours is a short window, but it did not need to be long. The damage here was mostly capped by dumb luck (missing admin rights) rather than by any defense Cursor or Anthropic had built in, and Phorion’s warning is the one to keep in mind: a planted key does not care that the lock happened to be shut when it was poured. If you or anyone on your team installed or updated the Claude Code extension through Cursor on October 29, run the authorized_keys check today, not after the next sprint. Supply-chain attacks on developer tools are not a rare genre anymore, and the fix is the same every time: assume compromise until you have actually checked, not until someone tells you to.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
