Cursor pulls trojanized Claude Code extension that tried to plant SSH backdoor

Cursor said on October 29 that a tampered build of the Anthropic.claude-code extension, version 2.1.313, was live in its VS Code marketplace from about 2:27am PT to 1:35pm PT. At most 5,000 users were affected, the company says, and it states that Anthropic did not develop the malicious version.

The payload fired on load. OpenSourceMalware found a 66-line loader inserted ahead of the legitimate code, so no Claude conversation was needed. It collected hostname, username, public IP and environment variable names, then tried to add an attacker SSH key labeled svc-telemetry, enable the local SSH service and open a reverse tunnel, retrying about every 60 seconds. Per Cursor, the SSH step generally failed because of errors in the malicious code unless Cursor ran with administrator rights.

Cursor had the attacker server taken offline, shut down the marketplace, rotated keys and rebuilt it. It warns that uninstalling may not be enough, since the payload drops standalone persistence scripts, and asks users to update to 2.1.314. OpenSourceMalware says the npm package, the OpenVSX extension and the Microsoft VSCode extension for Claude are not malicious. Our earlier report covers the first notice.

My take: the SSH-enablement step generally tripped over the attacker's own code. That is not a security strategy. And the sources do not say how a build got published under Anthropic's real publisher ID. That is the question that matters.