Tampered Claude Code Build Hit Up to 5,000 Cursor Users With an SSH Backdoor

Cursor disclosed on October 29 that a maliciously modified build of Anthropic's Claude Code extension was served from its VS Code extension marketplace for about 11 hours. The build identified itself as anthropic.claude-code version 2.1.313, the extension's real ID rather than a lookalike. Cursor puts exposure at no more than 5,000 users and says the version "was not developed by Anthropic."

The Hacker News carried statements from Jenn Gile, co-founder of OpenSourceMalware, and security researcher Paul McCarty. Help Net Security reported the analysis by macOS security firm Phorion, and StepSecurity published a registry timeline and additional hashes. None of the notices cites a CVE: this is a poisoned release rather than a flaw in the extension's code. Gile noted that while the version was pulled quickly, anyone with auto-update on could have received it.

What the Build Did

The change was small and sat at the front of the bundle. Gile described a 66-line loader inserted before the legitimate code in the main JavaScript file. StepSecurity measured the malicious extension.js at 3,692,922 bytes, about 7 KB larger than the clean 2.1.312. Phorion CEO Calum Hall told Help Net Security the injected function runs when Node loads the file, before the extension's activate step, and needs no user interaction.

From there, the sources describe the same sequence:

• Access: adds an attacker-controlled key with the comment svc-telemetry to the SSH authorized keys file and tries to enable the local SSH service.
• Tunnel: opens a reverse SSH tunnel to 134[.]209[.]82[.]225 that exposes local port 22 to the attacker. Standalone scripts retry about every 60 seconds and keep running after the editor closes.
• Persistence: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon on Windows with a Startup folder fallback, and a cron entry at reboot on Linux, as reported by Phorion and The Hacker News. Cursor's indicators cover the macOS and Windows builds.
• Reconnaissance: posts JSON over plain HTTP to port 8099 with public IP, hostname, username, OS, architecture, home and working directories, and the global Git email.
• Credential mapping: includes the names, not the values, of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.

No follow-on payload has been reported. Cursor says it worked with the hosting provider to take the attacker's server offline, which stops the tunnel and the beacon.

The Admin Rights Caveat, and Its Limit

Cursor says that turning on the SSH service requires admin rights the extension lacks on most macOS and Windows hosts, so on those hosts "the step fails and the attacker could not have logged in through the tunnel." The key, the persistence and the beacon still land, and Cursor says to remediate regardless.

Phorion draws the line differently. Hall called the macOS failure a bug rather than a defense: on a Mac with Remote Login already on, or one where the user turns it on later, the backdoor is ready to use. "The goal of this payload is long-term interactive access," he told Help Net Security. StepSecurity adds that interactive access was most likely where the editor ran elevated. Developer machines are a population where Remote Login and elevated sessions are both ordinary, so "most hosts" should not be read as "this host."

Cursor's Marketplace or Open VSX? The Sources Disagree

This is the open question that changes who should be looking. Cursor's notice speaks only to its own marketplace. Phorion reported spotting the version on Open VSX, the Eclipse Foundation registry that VS Code forks rely on, and StepSecurity's timeline has it published to Open VSX and reaching Cursor through a mirror sync. Against that, The Hacker News corrected its story to say the incident traces to a compromise of Cursor's marketplace rather than Open VSX, and Ax Sharma of Manifold Security disputes that the Open VSX version was compromised.

We checked what can be checked from outside. On October 30, the Open VSX API returned not found for 2.1.313 and returned 2.1.312 and 2.1.314, with 2.1.314 published at 01:07 UTC that day. That does not settle it, because a purged version and a version that never existed look the same from there. Anthropic's public changelog moves from 2.1.312 straight to 2.1.314, with no 2.1.313 entry. Phorion reported no malicious version on Microsoft's Visual Studio Marketplace.

Indicators of Compromise

From Cursor's notice unless marked, defanged as published there. Cursor notes that lookups to ifconfig[.]me and api[.]ipify[.]org are legitimate services and not indicators on their own.

What Cursor Did, and What It Tells Customers

Cursor removed the version, shut down its marketplace as a precaution, audited access and reports finding no other tampered extensions, rotated keys, then rebuilt the marketplace and brought it back online. It says it has no evidence that other versions of the extension or the official distribution are affected.

Its notice tells affected customers to search endpoint, network and extension telemetry for the indicators above, isolate hosts showing execution, remove the key, persistence and tunnel processes, assess whether to rebuild, and rotate credentials and sessions reachable from those hosts using a trusted system. Cursor stresses that collecting only variable names does not rule out later credential access over the backdoor. Its notice carries the check steps and the macOS and Windows cleanup scripts. Phorion also suggests reviewing SSH logs for localhost logins that used the svc-telemetry key.

What Is Still Unknown

• How the modified build entered the marketplace. Cursor's rotation and rebuild describe the response, and we found no published root cause as of this writing.
• Who ran it. No source names an actor.
• Whether any tunnel carried an interactive session, on which hosts.
• Whether exposure reached beyond Cursor, which turns on the Open VSX question above.

RedEye Assessment

Three points are worth carrying past this incident. First, checking the publisher would not have helped. This was the real extension ID, delivered as a routine update, and an allowlist of approved extensions would have passed it. Sharma made the same point: "Checking the publisher name doesn't help when the publisher is real." Controls that do apply here are version pinning, a delay on new releases, and knowing which registry each editor in the fleet pulls from.

Second, read the reconnaissance as a target list. Names of environment variables, a Git email and a working directory tell an operator which developer machines lead to cloud accounts and source control. The server is offline, but taking it down does not remove a planted key from a host, so a machine that received this build stays in an unknown state until someone looks. Until the Open VSX question is resolved, we would include every Open VSX based editor in that look rather than Cursor alone.

Third, the behavior is loud even though the package was quiet. An editor process writing to authorized_keys, spawning ssh -R or autossh, and dropping a LaunchAgent under a com.apple name is not normal for a coding extension. In Sharma's words, "a coding extension planting SSH keys should be caught in seconds." Whether that is true in a given organization depends on whether developer endpoints send that telemetry anywhere, and many are exempted from the controls applied to the rest of the fleet.

RedEye Security can assess whether your developer endpoints would surface a build like this one and review what those machines can reach. Contact our team to schedule an assessment.

Sources

• Cursor: security notice, malicious version of Anthropic.claude-code (2.1.313)
• The Hacker News: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
• StepSecurity: Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines