Tampered Claude Code extension in Cursor's marketplace tried to plant SSH backdoors on developer machines

Claude Code's extension adds Anthropic's coding assistant to VS Code-style editors. Cursor runs its own marketplace, which routes extension search and downloads through a Cursor proxy and uses Open VSX, an open extension registry, for third-party extensions. Cursor says modified builds of Anthropic.claude-code were available there from about 2:27am to 1:35pm PT (09:27 to 20:35 UTC) on October 29. A sample analysis by StepSecurity found the clean 2.1.312 code with a 7,386-byte loader added at the front. The loader ran when the file loaded, with no need to use Claude. Phorion's chief technology officer told Ars that Cursor extensions update automatically by default, though users can change that setting. WIRED describes Cursor as owned by SpaceX, and Cursor's notice refers to its "other SpaceXSI products." No source gives ownership a role in the failure.

What the malware attempted. It tried to collect host and user details, add an attacker's key to the SSH authorized_keys file (the list of keys allowed to log in), turn on the local SSH service, open a reverse tunnel (an outbound connection that lets the outside server reach back in) to 134.209.82.225, set up restart persistence and send a report to that server over plain HTTP. The report carried hostname, username, operating system, architecture, home and working directories, Git email, public IP and up to 40 environment variable names matching terms such as KEY, TOKEN and SECRET. Phorion and Microsoft say variable names were sent, not their values. (Cursor notice; Phorion; Microsoft)

What worked. Cursor states: "The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker." Daylight reports related activity on two customer MacBooks. On Host A, the extension host wrote com.apple.sysmond.plist and later connected to the attacker address. On Host B, the same process lineage triggered Launch Agent and authorized_keys detections and ran the SSH tunnel command, although Daylight could not recover which extension was responsible on that host. One of those hosts connected to the attacker's address on port 22 and on port 8099. On Windows, a scheduled task running as SYSTEM needs administrator rights, so Phorion describes a fallback to the user's Startup folder. Microsoft cautions: "A running SSH process does not necessarily mean the attacker gained access."

What failed. Cursor says the attempt to turn on SSH failed on most macOS and Windows hosts because the extension lacked administrator rights and contained implementation errors. Cursor says this step fails on most macOS and Windows hosts and that on those hosts "the attacker could not have logged in through the tunnel." Phorion traces specific bugs: on macOS the script reads an administrator error as not being "Off" and skips the enable step, and on Windows the setup command goes through /bin/sh, which standard Windows installs lack. Daylight saw no evidence that Remote Login was successfully enabled on its hosts.

Where the failure does not protect a machine. The bug stops the malware from turning SSH on. It does not protect a machine where SSH was already running. Phorion writes: "If the user already had Remote Login enabled, or turns it on later, the backdoor is ready and waiting." BleepingComputer reports the same limit for both platforms. Cursor also names machines where Cursor ran with administrator rights as an exception. No source counts hosts in either group, and Cursor's "most" is not quantified. Microsoft adds that success also depended on the attacker's server settings.

Which versions and systems (conflict resolved in part). Cursor's first notice named only 2.1.313. Its October 30 revision names 2.1.312 and 2.1.313 for Windows and macOS, with separate file hashes for darwin-arm64 and win32-x64, and no longer lists the first notice's macOS hash, while the first notice's Windows hash now sits under 2.1.312. Cursor's dated line says only that it updated indicators and clarified versions. BleepingComputer's article predates that revision. Ars was published at 21:09 UTC, after the revision, and still cites 2.1.313 only. The genuine 2.1.312 is a separate artifact: Open VSX dates it to October 27, and StepSecurity checked that copy and found it clean. Version number alone therefore does not identify an affected machine. On Linux, the code contains a Linux path and Cursor's revised indicators list Linux file paths, which supports Ars's statement that the code was written for Linux. WIRED goes further and describes a live extension "for Windows, macOS, and Linux." No source read here identifies a Linux package or a Linux victim, and Cursor's check and cleanup instructions cover macOS and Windows only.

Which channels (early reports retracted). Early accounts, including Phorion's first version, OpenSourceMalware's first version and Help Net Security, pointed to Open VSX. BleepingComputer says initial reports suggested npm, Open VSX and Microsoft's marketplace were also affected, and that Cursor was later confirmed as the only source. Microsoft says the packages were never published or distributed through its Visual Studio Marketplace or npm @anthropic-ai/claude-code. Open VSX's API returned "not found" for 2.1.313 when checked, The Hacker News relays Socket's review of Open VSX records and logs as finding no sign of it, and The Hacker News, Phorion and OpenSourceMalware corrected their accounts. Socket's own post could not be read.

UNEXPLAINED: attacker gets the ability to place builds in Cursor's marketplace
  -> tampered builds labeled 2.1.312 and 2.1.313 are served under Anthropic.claude-code
  -> Cursor installs or auto-updates the extension
  -> extension.js loads and the added code runs with the user's permissions
  -> REPORTED BY CURSOR AS WORKED: key added, persistence installed, host details sent
  -> OBSERVED ON AT LEAST ONE HOST: outbound SSH connection to the attacker's server
  -> USUALLY FAILED: turning on local SSH without administrator rights
  -> CONDITIONAL: login path exists only where local SSH runs and the attacker's server allows it
  -> NOT SHOWN IN ANY SOURCE READ: an actual attacker login

The failed boundary was the link between a publisher's name on a marketplace listing and the file actually delivered. Users received a build carrying the name Anthropic.claude-code, and Anthropic staff say Anthropic did not build or publish it. Phorion notes that an extension runs with the permissions of the editor and its user, so once it loaded, nothing further separated the added code from the user's SSH settings and startup folders.

The step that let the attacker in is unknown, so this diagram does not name one. Cursor's help page describes automated malware analysis on its proxy, a publisher verification badge, and optional team settings for signature checks and install delays. That page is undated, and no source says whether these controls applied to this upload, or why they did not stop it. This was a distribution failure: no source read here reports a flaw in Claude Code itself or any action by the Claude model.

People who installed the tampered build are told to check for the svc-telemetry key, isolate affected hosts, remove the key and startup items, consider rebuilding, and rotate credentials and sessions from a trusted system. Cursor warns that uninstalling may not be enough, and Microsoft says that removing or updating the extension leaves those files in place, so updating to 2.1.314 is not a cleanup. Cursor adds: "The limited env-var collection does not rule out later credential access over the backdoor." Cursor also took its full marketplace offline for a period it has not specified.

Cursor says the extension sent host and user information, including Git email, username and public IP, plus names of credential-style environment variables. Daylight reports that one customer Mac connected to the server's port 8099, but it does not publish the beacon contents or server-side receipt logs. That list tells an operator which hosts to prioritize, in Phorion's reading, and it is not theft of the values. Microsoft states the same limit. Phorion also reports a Linux bug in the persistence code that can wipe a user's existing cron jobs on repeat runs. OpenSourceMalware cautions that commands run after an SSH login would not appear in a static sample. Cursor says its work with the hosting provider disabled the attacker's server, so the tunnel and report no longer function. Cursor does not date the takedown. The earliest archived notice, from 08:43 UTC on October 30, already says the server no longer functions, and Beaumont reported it offline at 10:21 UTC that day. The start of that exposure period for any given host, and whether anyone used it, are not measured.

No source read here reports a confirmed attacker login, stolen credential values, a second-stage download, a named victim organization, financial loss or an attacker identity. That absence reflects the public record through this check. It does not show that none occurred. Beaumont's early statements that the backdoor reached "millions of endpoints" and that "every org will have been impacted" are not supported by the later evidence on distribution channels or by Cursor's bound. (Beaumont on Mastodon; Microsoft)

Cursor. Cursor removed the build, blocked further distribution and shut the marketplace. It says: "We audited access and confirmed no other extensions were tampered with." It rotated keys, rebuilt and restored the marketplace, had the server taken offline, published indicators and cleanup scripts for macOS and Windows, and told customers on X to update to 2.1.314. These are Cursor's accounts of its own actions, and no outside audit was found. Cursor has not published a root cause or post-mortem as of this check. It did not answer WIRED or Ars on how the upload happened, and BleepingComputer was awaiting a reply. OpenSourceMalware says Cursor told it the extension "experienced some form of compromise" and that it did not respond to later requests for details. OpenSourceMalware also says it understood from a meeting with Cursor that the compromise was larger than this one extension. That is OpenSourceMalware's reading, and it sits against Cursor's statement that no other extension was tampered with. (Cursor notice; Cursor on X; WIRED; Ars; OpenSourceMalware)

Anthropic. The response found consists of staff statements, not a formal company notice. Rieseberg wrote, as quoted by WIRED: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.” Dworken wrote on Hacker News that "2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts" and called Cursor's "a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing." The X posts themselves were reachable only as truncated embeds, so the full Rieseberg text rests on WIRED and on his matching Hacker News comment. Microsoft says Anthropic confirmed the same position to it. Ars and Reuters report no reply from Anthropic to their questions at the time. No notice about this incident appeared on Anthropic's news page, status page or the Claude Code advisories page when checked, and private customer messages would not show there. Anthropic published 2.1.314 on October 29 PT. Beaumont read the missing 2.1.313 as Anthropic "silently" removing a backdoor. Dworken's explanation and the registry record point the other way: the number was never published on Anthropic's channels. (Hacker News comments; Microsoft; Reuters via WSAU; Beaumont)

Microsoft. Microsoft published detection and hunting guidance. It also confirmed that its own marketplace and the npm package did not carry the build, and said: "At this time, all evidence suggests that the incident is limited to Cursor marketplace."