# A malicious Claude Code extension reached up to 5,000 Cursor users

Cursor says a modified Claude Code 2.1.313 package attempted to add an SSH backdoor and persistence. Cursor found no evidence that other extension versions or Anthropic's official distribution were affected.[1]

Cursor disclosed that its extension marketplace served a maliciously modified Anthropic.claude-code 2.1.313 package for about 11 hours on October 29. Cursor estimates that at most 5,000 users were affected.[1] The injected code collected host details, added an attacker-controlled SSH key, tried to enable SSH, created persistence and opened a reverse tunnel. Cursor worked with the hosting provider to take the attacker server offline, but warns that uninstalling the extension may not remove files and persistence already written to a host.[1] Cursor and the researchers have not established publicly how the package entered the marketplace, who operated it or whether any attacker used the backdoor for follow-on access.[1][2][3]

## What Cursor confirmed

[Cursor's security notice [1]](https://cursor.com/blog/claude-code-extension-security-notice) says its VS Code extension marketplace made a maliciously modified Anthropic.claude-code 2.1.313 package available from about 2:27am to 1:35pm Pacific time on October 29. Cursor puts the affected population at no more than 5,000 users and says it will contact them directly.

Cursor removed the package, shut down the marketplace, audited access, rotated keys and rebuilt the marketplace. It says no other extensions were tampered with and the hosting provider took the attacker's server offline.[1]

The incident concerns a modified package in Cursor's marketplace. Cursor says Anthropic did not develop the malicious version and reports no evidence that another version or the official distribution was affected.[1]

## What the injected code attempted

[OpenSourceMalware's static analysis [2]](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) found a 66-line loader before the legitimate extension bundle. The loader ran when the extension activated, so a user did not need to start a Claude conversation.

The code collected the hostname, username, operating system, architecture, home and working directories, Git email, public IP and the names of up to 40 environment variables associated with keys, tokens, secrets, passwords or cloud providers.[1][2] It did not place the environment-variable values in the initial beacon, although an attacker with remote access could have collected more data.[2]

The package added an attacker key labeled svc-telemetry to authorized_keys, attempted to enable the local SSH service, opened a reverse SSH tunnel and installed platform-specific persistence. Cursor says SSH enablement failed on most macOS and Windows hosts because the extension lacked administrator rights, but the key, persistence and host-details beacon could still run.[1]

## Who needs to investigate

Prioritize machines that installed or updated Anthropic.claude-code 2.1.313 from Cursor's marketplace during the stated exposure window.[1] Check fleet extension inventories and endpoint telemetry rather than relying on a developer's memory.

[Socket reviewed public registry records [3]](https://socket.dev/blog/claude-code-extension-compromise) and found no 2.1.313 publication or removal event in Open VSX, no npm publication record and no matching public GitHub release. Researchers therefore found only Cursor's marketplace in the known distribution path.

[OpenSourceMalware corrected its initial distribution account [2]](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor). It says the known malicious package came from Cursor's marketplace, while the Open VSX and Microsoft VS Code Marketplace extensions and the Claude Code npm package were not malicious.

## Response checklist

- Confirm whether the host installed anthropic.claude-code 2.1.313 from Cursor's marketplace between 2:27am and 1:35pm PT on October 29.[1]
- Search for Cursor's macOS and Windows VSIX hashes, the svc-telemetry key and fingerprint, administrators_authorized_keys, com.apple.sysmond, SysMon, the Startup-folder sysmon.cmd, Unix .smt and .smtk files, Windows smt.cmd and smtk files, .stk_<hex>, reverse SSH commands and HTTP POST traffic to port 8099 /beacon.[1][2]
- Isolate any host where telemetry shows that the payload ran, and block 134.209.82.225 on ports 22 and 8099. Preserve endpoint, SSH, shell, process, extension-installation and network records before cleanup.[1][2]
- Use Cursor's remediation script after evidence collection. Run the macOS script as the affected user, rather than root, and run the Windows script from an elevated PowerShell session. Check whether the payload enabled macOS Remote Login or Windows OpenSSH Server, and disable unauthorized SSH service access. Uninstalling the extension may not be sufficient because the loader wrote standalone files.[1]
- On Linux, inspect and remove the svc-telemetry key, the user crontab @reboot entry, .smt, .smtk, .stk_<hex> and active tunnel processes after collecting evidence. Check whether sshd was enabled and disable it when it is not authorized. Cursor did not publish a Linux cleanup script.[1][2]
- Rotate credentials and sessions reachable from the host, using a trusted machine. Review cloud, source-control, package-registry, signing and CI access that the affected user or workstation held.[1]
- Rebuild the host when logs show successful remote access, when forensic coverage is incomplete or when your assurance requirements cannot accept residual uncertainty.[1][2]

## What remains uncertain

- Cursor has not explained how the modified package entered its marketplace.[1][3]
- Cursor and outside researchers have not identified the attacker publicly or established who controlled the server.[1][2]
- Cursor has not stated how many of the maximum 5,000 affected hosts executed every payload stage.[1]
- Cursor says the SSH service step failed on most macOS and Windows hosts without administrator rights, but Cursor has not provided a count of successful tunnels or follow-on sessions.[1]
- Cursor says its audit found no other tampered extensions. Socket independently checked public Open VSX, npm and GitHub release records, but those records do not cover Cursor's complete internal marketplace audit.[1][3]
- The public Claude Code release list and changelog skipped 2.1.313, and the 2.1.314 changelog did not explain the incident when Socket reviewed it.[3]

## What development teams should change

Treat IDE extensions as executable software with access to source code, credentials and developer sessions. Record the registry, publisher, version and package hash in fleet inventory so responders can answer exposure questions without checking machines one by one.

Send extension installs and updates through a controlled allowlist or internal mirror where the organization can pin versions and retain artifacts. Do not treat a trusted extension identifier as proof that every artifact distributed under it is safe.[1][2]

Keep developer credentials short-lived and scoped, and separate signing or production access from everyday workstations. Endpoint controls should alert on edits to authorized_keys, unexpected user persistence and reverse tunnels from editor processes.

## Frequently asked questions

- Was Anthropic's npm package compromised? OpenSourceMalware says it was not malicious, and Socket found no npm record for 2.1.313. The known malicious artifact came from Cursor's marketplace.[2][3]
- Is uninstalling the extension enough? Cursor says it may not be sufficient because the payload writes standalone persistence scripts.[1]
- Are all Cursor users affected? No. The stated scope is users who received 2.1.313 from Cursor's extension marketplace during the exposure window.[1]
- Did the attacker obtain remote access? Cursor says the SSH enablement step failed on most macOS and Windows hosts without administrator rights. Cursor has not provided a count of successful tunnels or follow-on sessions.[1]
- Is the attacker server still online? Cursor says the hosting provider took it offline, so the tunnel and beacon no longer work at that endpoint.[1]
- Should an affected machine be rebuilt? Cursor tells users to assess whether rebuilding is needed. Choose a rebuild when remote access may have succeeded or when logs cannot rule out follow-on activity.[1][2]

## Sources

- [[1] Cursor: security notice, indicators and remediation](https://cursor.com/blog/claude-code-extension-security-notice)
- [[2] OpenSourceMalware: static analysis of the malicious artifact](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor)
- [[3] Socket: registry records and corrected distribution scope](https://socket.dev/blog/claude-code-extension-compromise)