Why it mattersA developer who installed Claude Code from the Cursor marketplace in that eleven hour window has a backdoor. The fix is to run Cursor's script and rotate every credential the laptop reaches.
A copy of the Claude Code extension on Cursor's marketplace carried a backdoor for about eleven hours on 29 October. Cursor published a security notice the next day. The notice names the exact extension and the two bad versions. The extension is Anthropic.claude-code. The two versions are 2.1.312 and 2.1.313, on Windows and macOS. A reader who installed it in that window needs to run Cursor's remediation script and rotate credentials.
Cursor said the bad builds were live from 2:27am to 1:35pm Pacific time. It also said they were not developed by Anthropic. The real Claude Code extension lives on Open VSX and npm. Those builds were untouched. Cursor's advisory says: "These malicious versions of the extension were not developed by Anthropic."
What the backdoor does on a user's machine
Cursor lists what the extension does after install. It reads host and user data: hostname, username, operating system, architecture, home directory, Git email and public IP. It sends that data out. It then writes an attacker SSH key into the user's authorized_keys file. It enables the SSH service. It opens a reverse SSH tunnel to 134.209.82.225. It writes a persistence file: LaunchAgent on macOS, a scheduled task on Windows.
Calum Hall at phorion.io published the first independent write-up and named the markers of compromise. The attacker's SSH key comments are svc-telemetry on the login key and svc-telemetry-tun on the tunnel key. The macOS persistence file is ~/Library/LaunchAgents/com.apple.sysmond.plist. The bad extension's SHA-256 is ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.
What a developer who was in that window should do
Cursor links two remediation scripts, one for macOS and one for Windows. Each one looks for an SSH key with the svc-telemetry comment. It removes the key. It removes the persistence file. It stops any running tunnel. Cursor also tells readers to rotate credentials the affected machine could reach. That covers Git tokens, cloud credentials, package registry tokens, and session cookies cached locally. An unknown attacker had SSH access. Anything a shell on that machine could read is burned.
An install from the official Open VSX listing, from npm, or from Anthropic's own GitHub release is not affected. The attack lived on one marketplace, for one short window. The real distribution channels were untouched. Anthropic's systems were not breached. A package name was reused on a marketplace readers trusted.
A review step on the marketplace side is the only thing that would have caught this. The eleven hour window is the measure of what happens when there is none. Cursor says it now reviews each extension more carefully. Teams that let people install coding extensions on work laptops without a review face a choice. Is this one incident, or is it the shape of the next one? If it is a pattern, the next backdoor will come through the same door.
Source
Cursor: Security notice, malicious version of Anthropic.claude-code identified in the Cursor VS Code Extension Marketplace. First disclosure: phorion.io: Official Claude Code VSX compromise by Calum Hall. Discussion on Hacker News.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
