Cursor's marketplace offered a backdoored Claude Code extension for 11 hours
The Cursor code editor.
A malicious version of the Claude Code extension was available in Cursor's VS Code extension marketplace for about 11 hours on 29 October, from roughly 2:27 am to 1:35 pm Pacific time. Cursor's security notice names versions 2.1.312 and 2.1.313 for Windows and macOS and says they were not developed by Anthropic. Cursor has said at most 5,000 users were affected.
The modified code tries to collect details about the machine, add an attacker-controlled SSH key, enable SSH, open a reverse tunnel and keep itself running after a restart. Cursor says enabling SSH would usually fail without administrator rights. The security firm Phorion says that on macOS the key and persistence are installed even when that step is skipped, and that the code also has a persistence routine for Linux.
Uninstalling the extension may not be enough. Cursor advises anyone affected to look for the svc-telemetry key in their SSH authorized keys, isolate affected machines, remove the key and persistence, run its cleanup scripts and rotate any credentials reachable from those machines. It says the attacker's server is now offline.
Neither Cursor nor Phorion says who is behind the attack or how the modified extension reached the marketplace.