Backdoored Claude Code builds were limited to Cursor

The tampered Claude Code builds 2.1.312 and 2.1.313 sat in Cursor’s extension marketplace for about 11 hours on October 29 and never reached the Visual Studio Marketplace or npm, Microsoft Threat Intelligence found in an October 30 analysis. Anthropic also confirmed to Microsoft that its own systems were not compromised. So only machines that installed or auto-updated to those builds through Cursor need checking, and on those machines, removing or updating the extension leaves behind the SSH key, tunnel identities and startup scripts the loader wrote outside its folder.

Cursor puts the exposure window at about 2:27 AM to 1:35 PM PDT. For affected machines, Microsoft says to collect evidence before any cleanup: the extension package, the modified SSH authorization files, the generated keys and scripts, and the startup configuration. Isolate devices that show the loader ran. Rotate credentials and revoke sessions from a known-clean device when telemetry points to credential access, or when the device can’t be trusted again.

Where the loader leaves traces

The SSH key comes first. On macOS and Linux, check ~/.ssh/authorized_keys for an entry ending in the comment svc-telemetry. On Windows, check both %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys, where they exist. Microsoft says to match the key against the fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and remove only that exact entry, leaving other keys and legitimate remote-development setups alone. A missing marker does not clear a machine by itself.

The persistence artifacts depend on the platform:

• macOS: a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, set to RunAtLoad and KeepAlive, plus ~/.config/.smt and ~/.config/.smtk.
• Linux: a user-crontab @reboot entry that points to ~/.config/.smt, plus the same two files.
• Windows: a scheduled task named SysMon that asks to run as SYSTEM, with %USERPROFILE%\.config\smt.cmd and %USERPROFILE%\.config\smtk. If that fails, a sysmon.cmd batch file goes into the user’s Startup folder.
• All platforms: a hidden temporary key file named .stk_ plus ten hex characters, and running SSH or retry processes.

The names were picked to look like monitoring components, so Microsoft says to inspect what each startup object actually launches before deleting it. On the network side, the configured server is 134.209.82[.]225, which also receives the host report at a /beacon endpoint on port 8099. Cursor’s security notice includes check and cleanup scripts for each platform. Microsoft says to review them before running them, then confirm that none of the listed artifacts remain and that nothing comes back after a login or restart.

Did the attacker actually get in?

The injected JavaScript runs as soon as the extension module loads, before the extension’s own code, and then lets the extension work normally. It installs the key, tries to switch on the local SSH service, and opens an outbound connection that asks the attacker’s server for a port and forwards it to port 22 on the workstation. Because the laptop dials out, inbound firewall rules don’t block it. The SSH command disables host-key checking and avoids prompts. It uses autossh on Unix-like systems when it can, and a hidden PowerShell loop on Windows, and it retries 60 seconds after each exit.

A running tunnel process does not mean someone logged in, Microsoft says: both the attacker’s server and the workstation have to accept the connection. Cursor says switching on the local SSH service needs admin rights, which the extension lacks on most macOS and Windows hosts. On those hosts that step fails and the attacker could not have come in through the tunnel. But the key, the persistence and the host report could still land. Cursor’s admin-rights point covers macOS and Windows. The loader also carries a Linux path, and Cursor added Linux indicators to its notice the next day.

The host report includes the hostname, username, OS, architecture, home and working directories, and the global Git email. It also lists the names of up to forty environment variables that contain strings such as KEY, TOKEN, SECRET, PASS, AWS or GCP. Microsoft notes the callback carries the names of those variables and none of their values. Cursor’s list also includes the public IP.

How many users were exposed

Cursor’s first notice and its X post said “at most 5,000 users.” The revised notice, published at 11:30 am Pacific on October 30, names both versions, adds four VSIX file hashes and Linux indicators, and no longer gives any number, Rescana reports. That leaves the 5,000 ceiling only in the earlier statements. Microsoft’s hash, ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, is for the JavaScript entry point and is not a VSIX package hash.

Cursor says it removed the malicious version and shut down the marketplace. It then audited access, confirmed no other extensions had been tampered with, rotated its keys, rebuilt the marketplace and worked with the hosting provider to take the attacker’s server offline. Microsoft’s caveat still applies: taking the server down does not remove anything already written to a device. Separately, the security group OpenSourceMalware found the npm, Open VSX and Microsoft Marketplace packages clean and puts the current extension at 2.1.314 on Open VSX and the Microsoft Marketplace, Rescana says.

Cooldowns and publisher lists

For Cursor teams, Microsoft points to Cursor’s security-hardening guidance. That means limiting extensions to approved publishers and setting an installation cooldown, so newly published versions are held back for a while before they install.