Tampered Claude Code extension on Cursor's marketplace carried SSH backdoor; up to 5,000 users may be affected

There is no evidence that the update reached the Open VSX registry or Microsoft's VS Code Marketplace. One early report said that the extension was on Open VSX, and that was later corrected.

The timeline

The malicious versions were installed between about 2:27 am and 1:35 pm Pacific time on 29 October, which is just under 11 hours. Other reports put it at nearly 12 hours. By 30 October the malicious version had been removed, and Anthropic had published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.

The loader activates after VS Code starts and when the extension's webview opens. According to the technical report:

• It adds an attacker-controlled SSH key, labelled svc-telemetry, to the file authorized_keys in the user's .ssh folder.
• It tries to enable SSH on Windows, Linux and macOS.
• It opens a reverse tunnel to an address, 134.209.82.225.
• It installs persistence through a scheduled task, a crontab entry or a LaunchAgent.
• It sends host reconnaissance over unencrypted HTTP to the same address on port 8099. The data includes the public IP address, hostname, local username, operating system and CPU architecture, home and current directories, the global Git email and the names, but not the values, of up to 40 environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS or GCP.

No other follow-on payloads have been observed. Cursor says that enabling SSH needs administrator rights, which the extension usually lacks on macOS and Windows, so the tunnel probably could not be used there. It still says that the key, the persistence and the data exfiltration occur, and it advises following the remediation steps regardless.

Cursor says at most 5,000 users were affected and that it will contact them directly. It also says that the malicious version did not affect other extensions or products on its marketplace. No third party has verified the number, and it is a ceiling and not a confirmed count.

The report advises the following steps for anyone who installed version 2.1.313:

• Isolate the affected machine.
• Remove the unauthorised SSH key and the persistence mechanisms.
• Rotate credentials and sessions.
• Update the extension to 2.1.314 or later.

To check, look for the svc-telemetry entry in the authorized_keys file, for an unexpected scheduled task, crontab entry or LaunchAgent, and for connections to 134.209.82.225, especially on port 8099, and check whether the installed version of the extension is 2.1.313.

The reports found do not give a direct statement from Anthropic beyond the release of the clean version, and they do not say who is behind the attack. They do not say how many of the possible 5,000 users actually ran the malicious code, or whether any data was in fact stolen.