Backdoored Claude Code 2.1.313 hit up to 5,000 Cursor users

A tampered build of Anthropic’s Claude Code extension, version 2.1.313, was available in Cursor’s VS Code extension marketplace from about 2:27am to 1:35pm PT on October 29. Cursor says it reached at most 5,000 users and that it adds an attacker’s SSH key and installs persistence scripts. If you installed or updated the extension in Cursor during that window, check for the key first, because uninstalling the extension or moving to 2.1.314 leaves those scripts running.

Kevin Beaumont, writing on DoublePulsar, says the extension auto-updated to the malicious version inside Cursor and that Phorion, a macOS endpoint-detection vendor, was the first to notice the activity on endpoints. In his reading, the replacement, 2.1.314, appears to remove the backdoor from the extension, though he is not sure it contains no malicious code. It also does not remove the SSH backdoor from machines already infected, and it does not undo the earlier reconnaissance.

Checking a machine

The payload appends a public key labeled svc-telemetry to the user’s SSH authorized keys, and Cursor’s security notice builds its check on that label. On macOS, the check is grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". The PowerShell version for Windows also searches C:\\ProgramData\\ssh\\administrators_authorized_keys.

Phorion adds a caveat for anyone hunting across a fleet. Before adding the key, the script only looks for the svc-telemetry comment, so a search should also match the key’s fingerprint, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.

There are also files to look for. On macOS they are ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt and ~/.config/.smtk. On Windows, look for a scheduled task named SysMon, %USERPROFILE%\\.config\\smt.cmd and a sysmon.cmd in the Startup folder. On the network, the attacker endpoint was 134[.]209[.]82[.]225: the reverse SSH tunnel ran on port 22 and the beacons went to port 8099. Lookups to ifconfig[.]me and api[.]ipify[.]org also show up, but those are legitimate services and don’t count as an indicator on their own. For teams on Microsoft Defender for Endpoint, Beaumont has published KQL queries that hunt for the malicious version.

If the key is there, Cursor says to isolate the host and run its remediation script. On macOS that is remediate-macos.sh, run as the affected user, not as root. On Windows it is remediate-windows.ps1, run from PowerShell opened as Administrator. Then decide whether to rebuild the machine. The scripts remove the extension, the persistence, the running tunnel processes and the key, and they exit with a non-zero status if anything is left. After that, rotate every credential and session the host could reach, working from a trusted system. Cursor’s reason: the payload collected only a limited set of environment variables, but that does not rule out credential theft later through the backdoor.

What the payload does

Phorion found an immediately invoked function (code that runs the moment it is defined) added to the start of the minified extension.js. It fires as soon as Node loads the file, before the extension’s normal activate callback runs. So nobody had to open or use Claude Code in Cursor for the payload to run. Jenn Gile of OpenSourceMalware puts the injected loader at 66 lines, all placed before the legitimate extension code, per The Hacker News.

First, the code collects the hostname, the local username, the OS and CPU architecture, the home and current working directories, the global Git email and the public IP. It also takes the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP. Paul McCarty says the values are not placed directly in the initial beacon, though the names alone can still give information away.

Next, it tries to add the attacker’s key, turn on the local SSH service and open a reverse SSH tunnel back to the attacker’s server. To keep that tunnel alive, it installs a LaunchAgent on macOS. On Windows it creates a scheduled task that tries to run as SYSTEM, with a Startup-folder script as a fallback. Background scripts retry the tunnel roughly every 60 seconds, and host details and the backdoor’s status go out over unencrypted HTTP to /beacon on port 8099.

The tunnel step mostly failed. Turning on the SSH service needs admin rights, which the extension doesn’t have on most macOS and Windows hosts. Cursor says that because of errors in the code, the step fails unless Cursor itself was started with administrator privileges, and without it the attacker could not log in through the tunnel. Phorion traced one of those errors on macOS. Run as a standard user, systemsetup -getremotelogin prints an administrator-access error and exits with status 0 instead of returning Off. The script only enables SSH when it sees Off, so it skips that step, while the key and the persistence are still written.

The server on the other end is down as well. Cursor worked with the cloud provider hosting it to take it offline, so neither the reverse shell nor the host-detail POST works now.

Anthropic’s account, Cursor’s marketplace

Cursor says it has no evidence that other versions of the extension or the official distribution are affected. OpenSourceMalware’s updated post says the same of the npm package, the Open VSX extension and the Microsoft VS Code Marketplace extension: none of them is malicious, and the bad update went out only through Cursor’s marketplace. Beaumont shows that 2.1.313 is now missing from OpenVSX, the Visual Studio Marketplace and Cursor.

After detecting the build, Cursor removed it, blocked further distribution and then shut down its whole VS Code marketplace as a precaution. It audited access and found no other extensions had been tampered with. It then rotated its keys and rebuilt the marketplace before bringing it back online. Cursor also says it will contact affected users directly.

How the build got into the marketplace remains unclear. It shipped under Anthropic’s own extension ID, anthropic.claude-code, and OpenSourceMalware says Cursor told it that the extension in the Cursor Marketplace “experienced some form of compromise.” Cursor’s notice says the malicious version “was not developed by Anthropic.” Beaumont points out that it was uploaded under Anthropic’s verified account and writes that “‘Developed’ is doing some heavy lifting.”