> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Builders

The Claude Code Extension in Cursor's Marketplace Was Backdoored for 11 Hours

By alkizz ·

For about 11 hours on Oct 29, anyone who installed or updated the Claude Code extension from Cursor's own extension marketplace could have picked up a version that plants an SSH backdoor. Cursor says the bad build, Anthropic.claude-code 2.1.313, was live from about 2:27am to 1:35pm PT (5:27am to 4:35pm ET), that Anthropic didn't develop it, and that "at most 5,000 users" were affected. Phorion, a security vendor that sells detection for this kind of thing, published a teardown on Oct 30. The attacker's server is offline now, but what the extension left behind survives an update or uninstall, so this is a cleanup job, not a patch.

What Cursor and Phorion found

Cursor's notice is the official word, and Phorion agrees on the core. The extension adds an attacker's SSH key, labeled svc-telemetry, to ~/.ssh/authorized_keys, tries to switch on the machine's SSH service, and tries to open a reverse SSH tunnel to 134.209.82[.]225. It sets up persistence so the tunnel retries roughly every 60 seconds, and it sends a host report by plain HTTP POST to /beacon on port 8099.

Per Phorion, the code sits at the front of extension.js and runs "as soon as Node loads the file," so you never have to open a Claude chat, and OpenSourceMalware says the same. Phorion says the tunnel loop keeps going after you close the editor.

Persistence depends on the operating system, so no single machine gets all three:

The beacon is where the "names, not values" part comes in. Cursor says it collects hostname, username, OS, architecture, home directory, working directories, your configured Git email, your public IP and the names of environment variables. Phorion and OpenSourceMalware narrow that last one down: up to 40 variable names that match KEY, TOKEN, SECRET, PASS, AWS or GCP, which in Phorion's words gives the operator "a quick inventory of which cloud credentials or API tokens live on the machine."

The good news is that the scariest step mostly failed. Cursor says turning on SSH needs admin rights the extension doesn't have on most macOS and Windows machines, and that "due to errors in the malicious code" it would fail unless Cursor had been started as an administrator. On those machines the attacker couldn't log in through the tunnel. Phorion traces the macOS failure to a bug in the Remote Login check, but says not to rely on it, and Cursor says to clean up regardless because the key, the persistence and the host report still land.

Cursor says it pulled the version on detection, shut down and rebuilt the whole marketplace, rotated its keys, found no other tampered extensions, and got the hosting provider to take the attacker's server offline.

What nobody has confirmed yet

Nobody has said how the bad package got into Cursor's marketplace or who's behind it. Cursor's notice puts the incident in its own marketplace and doesn't mention Open VSX. Per OpenSourceMalware, citing Cursor, the extension "experienced some form of compromise" in the Cursor Marketplace and "this is the origin of the malicious Claude Code extension, not Open-VSX," and OpenSourceMalware's update lists the npm package, the Open VSX extension and Microsoft's VS Code extension as not malicious. The Hacker News has corrected its Open VSX attribution. Coralogix's Oct 30 advisory still said Open VSX when I checked this morning, and so did StepSecurity's write-up when we checked earlier. OpenSourceMalware's own write-up still says the "distribution source" remains "unverified," so the Cursor Marketplace origin is the best-supported account, not a confirmed one.

Anthropic hasn't said anything that I could find as of Oct 30, and Reuters reported that Anthropic "did not immediately respond to a request for comment." There's nothing on its status page, its news page or the Claude Code GitHub security advisories, and the Claude Code changelog goes straight from 2.1.312 to 2.1.314 with nothing about security in the 2.1.314 notes. Phorion says Cursor also pulled 2.1.313 from npm and the VS Code Marketplace, which no other source says. When I checked on Oct 30, npm, Open VSX and Microsoft's marketplace all showed 2.1.314 as the latest with no 2.1.313 listed at all, and Anthropic's GitHub repo has no 2.1.313 release or tag either, but no vendor has said why, or whether a clean 2.1.313 was ever published there. Cursor says it has "no evidence that other versions of the extension or the official distribution are affected."

Cursor hasn't confirmed any of the Linux details. They come from researchers reading the code (Phorion and OpenSourceMalware), and the cron-wipe bug is Phorion's alone. Cursor's indicators list only a macOS (darwin-arm64) and a Windows (win32-x64) build, and its remediation scripts only cover those two, so nobody has confirmed whether a Linux build went out. Phorion's claim that inbound logins over the tunnel would show up as coming from localhost is also Phorion's alone.

Why an extension is such a good place to hide

My opinion: this is the extension version of the LiteLLM trojan, and it worked for the same reason. People install the official package from the official store, auto-update does the rest, and nobody reads extension.js. The extension kept working normally too, and nobody uninstalls a coding assistant that's behaving fine.

Cursor's response was good: a notice with a window, a user count, indicators and cleanup scripts on the same day. What I'd still like is how it got in, since "we rotated our keys" invites the question of which keys, and some word from Anthropic, whose name is on the package.

The score

I'd call it a 4, act this week. If you used Cursor with the Claude Code extension on Oct 29, check today, because a planted SSH key and a startup task are a real backdoor even if the tunnel never connected. The window was short, the cap is 5,000 users, the attacker's server is down and, per Cursor, the login step failed on most macOS and Windows machines, which is why this isn't a 5. If you don't use Cursor, or you never updated the extension that day, this is mostly a reason to look at your extension controls.

What to do:

Sources

Related

On the checklist

More briefs

← All briefs