For about eleven hours on October 29, a fake version of the Claude Code extension, presented as the one from Anthropic, circulated on the Cursor marketplace. It attempted to install an SSH backdoor on developers’ computers: up to 5,000 maximum, according to Cursor.
What happened on the Cursor marketplace?
According to the security advisory published by Cursor, a modified version of the extension, Anthropic.claude-code 2.1.313, was offered between 2:27 AM and 1:35 PM Pacific Time. This corresponds to a window from 10:27 AM to 9:35 PM in France. The publisher states that this version was not developed by Anthropic and that it affected at most 5,000 users, whom it says it wants to contact directly.
Cursor removed the version as soon as it was detected, then as a precaution shut down its entire marketplace, changed its keys, and rebuilt the service. The company also says it got the attacker’s server taken offline by the hosting provider: the tunnel and data exfiltration would no longer be functional. It adds that there is no evidence that other versions of the extension are affected. Its message on X was relayed by The Hacker News:
What does this backdoor do on the machine?
According to the analysis by OpenSourceMalware, a 66-line loader was pasted before the legitimate code of the extension’s main file. It executes as soon as the extension loads: no need to open a conversation with Claude. It collects the machine name, user, system, global Git email address, and the names of environment variables containing words like “KEY” or “TOKEN”. The values are not included in the initial exfiltration, but the names alone are enough to reveal the services used.
The code then adds an SSH key labeled “svc-telemetry” to the authorized_keys file, attempts to enable the SSH service, and opens a reverse tunnel to the address 134.209.82.225. To persist, it installs itself under a deceptive name: on macOS, a LaunchAgent named “com.apple.sysmond”, which is not an Apple component; on Windows, a scheduled task “SysMon”. According to Cursor, scripts restart the tunnel approximately every 60 seconds and a report is sent to port 8099 on the server.
An attack partly limited by its own mistakes
This is not an automatic takeover. Cursor explains that enabling the SSH service requires administrator rights, which the extension does not have on most Macs and Windows PCs. On these machines, the attacker therefore would not have been able to connect via the tunnel. However, the key, persistence, and data exfiltration remain in place, which justifies cleaning up anyway.
Open VSX or Cursor marketplace: where did the malicious version come from?
Sources disagree. Cursor, and then The Hacker News in its corrected version, locate the distribution solely on the Cursor marketplace, with no evidence it reached Open VSX or the Microsoft Marketplace. Conversely, Help Net Security and the security company Phorion mention a package published on Open VSX, the registry managed by the Eclipse Foundation.
OpenSourceMalware, for its part, analyzed a copy retrieved from Open VSX, while specifying that the origin of the studied folder is not established. According to The Hacker News, Anthropic has since published version 2.1.314 on Open VSX and on the Microsoft Marketplace. We found no statement from Anthropic on the incident.
How to know if you are affected?
The question only concerns those who installed or updated Anthropic.claude-code 2.1.313 from the Cursor marketplace during the cited window. Cursor suggests a check: is the “svc-telemetry” key present in your authorized SSH keys? On macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"Cursor also provides a PowerShell command for Windows, but not for Linux. If the key appears, the machine is affected and Cursor recommends these steps:
- isolate the machine and look for the indicators of compromise listed in its advisory
- run the provided cleanup script for macOS or Windows, because uninstalling the extension is not enough: standalone scripts continue to run
- change credentials and sessions accessible from the machine, from a trusted system
One question remains that no one has settled: who actually published this version, and with what access?
