A poisoned copy of one of the most popular AI coding extensions reached developers through Cursor's own marketplace this week. Cursor disclosed on October 29 that version 2.1.313 of the Anthropic.claude-code extension listed in its VS Code extension marketplace was a malicious build that Anthropic did not create, and that at most 5,000 users had installed or updated to it. The company said it would contact those users directly.
According to Cursor, the tampered package was available from roughly 2:27 a.m. to 1:35 p.m. Pacific time. Once loaded, it gathered the machine's hostname, username, operating system, CPU architecture, home and working directories, the names of environment variables, the configured Git email address and the public IP address. It then tried to append an attacker-controlled key to the user's SSH authorized_keys file, turn on SSH locally and set up a reverse tunnel to a remote server, retrying about once a minute and reporting its status over HTTP to a beacon endpoint on port 8099.
The malware also tried to survive reboots. On macOS it registered a LaunchAgent disguised with an Apple-like name, and on Windows it attempted a scheduled task running as SYSTEM, falling back to a script in the Startup folder. OpenSourceMalware, which analyzed the package independently, found a 66-line loader inserted at the top of the extension's main JavaScript file, ahead of the legitimate code. Because it runs as soon as the extension module loads, a victim did not need to open a Claude conversation for it to fire. The researchers also found a Linux branch that adds a crontab entry at boot, and noted that the reconnaissance step collected the names, though not the values, of up to 40 environment variables that look like keys, tokens or secrets.
There are limits to the damage. Cursor said that enabling the SSH service needs administrator rights the extension lacks on most macOS and Windows machines, and that bugs in the malicious code made that step fail outside unusual setups, so the attacker could generally not log in through the tunnel. The rogue key, the persistence scripts and the host report were still written or sent. Cursor added that the attacker's server was taken offline with help from its hosting provider, which disables both the tunnel and the beacon.
Cursor's response went beyond pulling the single version. The company said it blocked further distribution, shut down its entire VS Code extension marketplace as a precaution, audited access, found no other tampered extensions, rotated its keys and rebuilt the marketplace before bringing it back. It has not said how the attacker got the modified package published. Reuters, reporting on the disclosure, described Cursor as owned by SpaceX and said Anthropic had not immediately responded to a request for comment.
Users who installed 2.1.313 from the Cursor marketplace during that window are told to check their authorized_keys file for a key labelled svc-telemetry, isolate any machine that shows signs of the payload, run Cursor's remediation scripts and rotate credentials from a trusted system. Cursor warned that uninstalling the extension is not enough, because the payload leaves standalone persistence scripts behind, and that the limited data collection does not exclude later credential theft over the backdoor.
Early public reports did not agree on where the bad build came from. Security firm Phorion described it as a compromise of the extension on Open VSX, while OpenSourceMalware updated its analysis after Cursor contacted it, saying the Cursor marketplace was the origin and that the Open VSX listing, the npm package and the Microsoft marketplace version were not malicious. Cursor itself says it has no evidence that other versions or the official distribution are affected.