Tampered Claude Code extension in Cursor's marketplace affected at most 5,000 users, Cursor says

Cursor disclosed on October 29, and updated its notice on October 30, that modified versions of Anthropic's Claude Code extension — anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS — were distributed through its VS Code Extension Marketplace. Cursor said on X that the incident affected "a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."

Cursor said the malicious versions were not developed by Anthropic. Felix Rieseberg, an Anthropic engineering manager, wrote on X: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.” The Hacker News reports that Anthropic security engineer David Dworken said on X that the versions on Anthropic's official channels, including VS Code and Open VSX, are not affected. OpenSourceMalware, which flagged the package, said it identified itself under Anthropic's legitimate extension ID, anthropic.claude-code, rather than as a separate extension.

The poisoned versions were live from about 2:27 a.m. to 1:35 p.m. Pacific Time on Thursday, October 29 — about 11 hours by Cursor's timeline. Security researchers at OpenSourceMalware flagged the package; its co-founder Jenn Gile told The Hacker News that "anyone who has their Claude Code instance set to auto-update could have consumed the malware."

Rieseberg said a malicious actor used access to Cursor's marketplace to publish the tampered copy; how that access was obtained has not been disclosed, The Hacker News reports. Cursor says it removed the versions, shut down the marketplace out of an abundance of caution, audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace, and brought it back online. It also worked with the cloud provider hosting the attacker's server to take that server offline, so the reverse shell no longer functions. Cursor said it will contact impacted users directly, according to The Hacker News.

The malicious code was a 66-line loader slipped in ahead of the legitimate extension code, according to OpenSourceMalware. It runs when the editor starts and when the extension's webview opens. It collects host and user details — hostname, username, operating system, architecture, home directory, working directories, Git email, public IP — plus the names of up to 40 environment variables containing words like KEY, TOKEN, SECRET, PASS, AWS, or GCP. The variable values were not sent in the first beacon, researcher Paul McCarty told The Hacker News, but their names alone reveal which cloud providers and credential types are configured.

According to Cursor and OpenSourceMalware, the payload then appends an attacker-controlled SSH key, labeled "svc-telemetry" to look harmless, to the machine's authorized_keys file, tries to switch on the local SSH service, and opens a reverse SSH tunnel to an attacker-controlled server. It also attempts to install persistence — a LaunchAgent on macOS, a scheduled task on Windows, a cron job on Linux — with background scripts retrying the tunnel roughly every 60 seconds.

Cursor says turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts; on those hosts the step fails and the attacker could not have logged in through the tunnel. Cursor says the extension still added the attacker's SSH key, installed persistence, and sent host details, and adds: “Follow the remediation steps below regardless.” The Hacker News reports no follow-on payloads have been observed.

Cursor's notice applies to anyone who installed or updated to anthropic.claude-code 2.1.312 or 2.1.313 from its marketplace on macOS or Windows between about 2:27 a.m. and 1:35 p.m. PT on October 29. Its macOS check is: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". On Windows, Cursor's notice gives a PowerShell check of the same two authorized_keys locations. Cursor says that if the key is found, the machine is impacted, and advises isolating it, removing the key, the persistence mechanisms, and any running tunnel processes, and rotating credentials and sessions from a trusted system. Cursor published remediation scripts for macOS and Windows that do the cleanup and exit non-zero if anything remains.

Cursor says uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts that keep running, and Microsoft says removing or updating the extension does not remove artifacts written outside its installation directory, The Hacker News reports. Microsoft also confirmed the malicious version was never published on its Visual Studio Marketplace or through npm, and Socket said it found no evidence other registries were impacted. The latest version published by Anthropic on Open VSX and Microsoft's VS Code Marketplace is 2.1.314, and users who installed Claude Code from those marketplaces are not known to be affected, according to The Hacker News.