News ·
Tampered Claude Code extension on Cursor: check your machine
On October 29 Cursor's marketplace served Claude Code versions 2.1.312 and 2.1.313 with an SSH backdoor. How to tell whether it affects you.
Claude Code 2.1.312, 2.1.313 · Source: cursor.com
What changes
On October 29, 2026, between 2:27 a.m. and 1:35 p.m. Pacific time, Cursor's extension marketplace distributed tampered copies of the anthropic.claude-code extension, versions 2.1.312 and 2.1.313, for macOS and Windows. Cursor's security notice confirms it and says those copies "were not developed by Anthropic".
When loaded, the injected code (before the extension started, with no action from you):
- Added an attacker SSH key, labelled
svc-telemetry, to~/.ssh/authorized_keys. - Tried to enable SSH and open a reverse tunnel to the server
134.209.82.225. - Set itself to start again (a LaunchAgent on macOS, a scheduled task on Windows).
- Sent machine details: host name, user, OS, Git email, public IP and the names (not the values) of environment variables such as
KEY,TOKENorSECRET.
Phorion, who found it, and StepSecurity give the details too.
What did not happen: some headlines say "Anthropic hacked". According to Cursor and Anthropic, it was not: Anthropic stated there was no compromise of its systems or employee laptops, that someone used access to Cursor's marketplace to publish the copy, and that its official channels are not affected (StepSecurity quotes the statement). The Visual Studio Code Marketplace, Open VSX and the Claude Code npm package did not serve the tampered copy. Anthropic skipped version 2.1.313 in its changelog (it goes from 2.1.312 to 2.1.314) to avoid confusion.
Cursor pulled the versions, shut down and rebuilt its marketplace, rotated its keys and, with its hosting provider, took the attacker's server offline. It estimates that at most 5,000 users received it and says it will contact them.
How to use it
1. Check whether you have the extension and where it came from
It only affects you if you installed it from Cursor that day. In a terminal:
cursor --list-extensions --show-versions | grep -i claude
code --list-extensions --show-versions | grep -i claudeIf Cursor shows anthropic.claude-code@2.1.312 or @2.1.313, go on to step 2. In VS Code, 2.1.312 comes from Microsoft's Marketplace and is not affected.
2. Look for the attacker's key
This is Cursor's check (macOS and Linux):
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"On Windows (PowerShell):
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }3. If the key is there
- Uninstalling the extension is not enough: the code leaves scripts that keep running on their own.
- Use the cleanup scripts in Cursor's notice (on macOS as your user, not root; on Windows in PowerShell as Administrator).
- From another, trusted machine, rotate the keys and sessions that machine could reach: GitHub, CI/CD, cloud, SSH keys, npm tokens and the like.
- Check SSH logs for
svc-telemetrylogins from127.0.0.1. If there are signs of use, consider reinstalling the system. - Then install version 2.1.314 or later from an official source.
Tested on Linux with VS Code 1.136.1: extension 2.1.312 installed from Microsoft's Marketplace does not contain 134.209.82.225 or svc-telemetry, its extension.js does not match the published hash, and the step 2 check says "No key found".
Does it affect you?
- Yes, if you use Cursor and Claude Code was installed or updated on October 29: do steps 1 and 2.
- No, if you use VS Code with the extension from Microsoft's Marketplace, Open VSX, or Claude Code in the terminal (npm or installer): according to Cursor and Anthropic, those channels were not touched.
- Still unknown: how the attacker managed to publish on Cursor's marketplace. Cursor has not explained it.