Cursor marketplace served a malicious Claude Code extension to up to 5,000 users
The modified package added an SSH backdoor and persistence; simply uninstalling it is not enough.
Cursor says a maliciously modified Claude Code extension was available through its VS Code extension marketplace for roughly 11 hours and reached at most 5,000 users. The affected package was Anthropic.claude-code version 2.1.313; Anthropic did not create the malicious build, and the official distribution was not affected.
The payload collected host and user information, added an attacker-controlled SSH key labeled svc-telemetry, installed persistence and attempted to open a reverse SSH tunnel. Enabling the local SSH service normally requires administrator rights, so Cursor says the tunnel failed on most macOS and Windows machines. The unauthorized key, persistence scripts and information beacon could still be installed.
Cursor removed the package, temporarily shut its marketplace, audited other extensions, rotated keys and rebuilt the service. It says no other extensions were tampered with, and the attacker’s server has been taken offline. The company will contact affected users directly.
Anyone who installed or updated the extension during the exposure window should update to version 2.1.314, check SSH authorized-keys files for svc-telemetry, run Cursor’s remediation script and rotate credentials and sessions accessible from the machine. Uninstalling the extension alone may leave persistence behind.
The incident is a serious supply-chain compromise because developer computers often contain repository access and production credentials. Cursor has not yet explained how the modified package entered its marketplace.
