Claude Code extension backdoor in Cursor's marketplace: what ran, what uninstalling leaves, and why the version number can't tell you which build you got

For about eleven hours on October 29, Cursor’s extension marketplace served tampered builds of Anthropic.claude-code, the Claude Code extension, versions 2.1.312 and 2.1.313, for macOS and Windows. Cursor’s window is 02:27 to 13:35 PT, which is 09:27 to 20:35 UTC. Cursor removed the builds, shut the marketplace down, rotated its keys, worked with the hosting provider to take the attacker’s server offline, and brought the marketplace back.

What did the backdoored Claude Code extension do?

It tried to open a way back into the machine as soon as the editor started, and whatever it managed to plant outlives the extension. No Claude conversation was needed. Both write-ups describe a loader prepended to extension.js; OpenSourceMalware counts about 66 lines. The official 2.1.312 manifest activates the extension on onStartupFinished, so the loader runs every time the editor finishes starting.

Per Phorion and OpenSourceMalware, it appends an attacker key with the comment svc-telemetry to ~/.ssh/authorized_keys, tries to switch on the SSH server, opens a reverse SSH tunnel to 134.209.82.225, and installs a launcher that reopens the tunnel every 60 seconds. It also sends a one-off report to the attacker’s server and to a local port: hostname, username, OS, home and working directory, your global git email, your public IP, and the names (not the values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. The code has a Linux branch too, though Cursor lists only macOS and Windows builds.

How much of that landed depends on the machine. Cursor says enabling SSH fails unless the editor was started with administrator privileges, and Phorion found a bug that often skips the macOS step entirely: without root, the status check prints an error the code doesn’t recognize. If nothing listens on localhost:22, the tunnel goes nowhere. The key file, the launcher and the report need no admin rights, so they could land even where SSH stayed off.

Is the official Claude Code extension affected?

Neither company has found evidence that it is, and nobody has said how the tampered builds got into the marketplace. Cursor says there is “no evidence that other versions of the extension or the official distribution are affected”. Cursor places the compromise in its own marketplace, not Open VSX, and OpenSourceMalware repeats that, so headlines naming Open VSX have it wrong. For Anthropic, The Register quotes Felix Rieseberg, a member of technical staff rather than a spokesperson, writing on X:

"it wasn't a compromise of Anthropic's systems or employee laptops."
"A malicious actor used access to Cursor's marketplace to publish a
tampered copy of the Claude Code extension"

A number of up to 5,000 affected developers has circulated since. The Register attributes it to unnamed industry figures, and nobody has confirmed it.

I pulled the official 2.1.312 darwin-arm64 build from Open VSX. The VSIX matched its published SHA-256, and its extension.js contains neither svc-telemetry nor the attacker’s address. That fits the official channel being clean. It says nothing about the tampered 2.1.312, which is gone.

Can the Claude Code extension version number identify a tampered build?

No, in either direction. 2.1.312 is a real release, published on GitHub on October 27, so the tampered copy reused a number you would expect to see. 2.1.313 has no GitHub release and no Open VSX listing, which looks like a tell until you notice that, as of October 31, 2.1.315 is missing from both as well. A missing number alone says nothing.

Nor does a registry signature. Open VSX signs the packages it serves, and the public key it lists for Anthropic’s extension is the same one it lists for Red Hat’s and rust-lang’s. My read: a valid signature there shows the registry signed the file, not that Anthropic built it.

The content is what settles it. Compare your installed extension.js against the same version and platform pulled from Open VSX. A matching hash means that file is the official one; it doesn’t clear anything the loader already planted. A mismatch is a reason to look closer, not a verdict, since I haven’t confirmed Cursor serves byte-identical files in the normal case.

What to check if Claude Code for Cursor updated on October 29

Uninstalling the extension removes none of this. Paths and names from Cursor, Phorion and OpenSourceMalware:

~/.ssh/authorized_keys          line ending in svc-telemetry
                                (Windows admins: also C:\ProgramData\ssh\administrators_authorized_keys)
~/.config/.smt, ~/.config/.smtk                      macOS, Linux
~/Library/LaunchAgents/com.apple.sysmond.plist       macOS (not an Apple component)
crontab @reboot entry running ~/.config/.smt         Linux
$TMPDIR/.stk_* (macOS), /tmp/.stk_* (Linux)          tunnel key
%USERPROFILE%\.config\smt.cmd, smtk, %TEMP%\.stk_*   Windows
scheduled task SysMon; Startup folder sysmon.cmd     Windows
ssh/autossh with -R *:0:localhost:22 to 134.209.82.225

If you find any of it, follow the order both advisories imply: take the machine off the network, keep the evidence, then clean up. Cursor publishes cleanup scripts for macOS and Windows. Rotate the credentials and sessions that machine could reach, from a different machine, whether or not SSH was ever on. Then look in the SSH server’s log for a login from 127.0.0.1 or ::1 with the planted key, which Phorion identifies by its fingerprint:

SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk

A hit means someone used the door. No hit doesn’t clear the machine, which is why both Cursor and OpenSourceMalware raise rebuilding it.

What the Cursor marketplace incident changes

I’ve argued that the tool you install has your reach, and that the grant is made once and never revisited. This week shows what “once” covers. An extension that updates itself keeps the grant while the code under it changes, on a schedule the marketplace picks.

So whoever can write to the update channel inherits the reach you gave the extension. Here that was two parties: Anthropic, whose name you checked, and Cursor’s marketplace, which nothing at install time presents as a party at all. The publisher name and the version pointed at the first. The code came from the second. Every check you get at install vouches for the channel; none says who built the bytes. And uninstalling revokes the grant going forward only. The key and the launcher were written with your authority, and they keep it.

Reading a skill doesn’t prove the file that runs, and a marketplace listing proves about as much. If you run Claude Code inside Cursor, the CLI you installed with npm or the native installer and the extension from Cursor’s marketplace come through different supply chains, and only the second was compromised this week.