Trojanized Claude Code extension sat in Cursor marketplace 11 hours
A trojanized Claude Code extension slipped into Cursor's marketplace for about 11 hours. The backdoor survives a simple version bump, so cleanup needs manual steps. Which distribution channel it used is still under investigation.
A tampered build of Anthropic's Claude Code for VS Code extension (versions 2.1.312 and 2.1.313) sat in Cursor's extension marketplace on October 29, 2026, for roughly 11 hours before Cursor pulled it. The 5,000-user exposure figure is Cursor's estimate, unverified by Socket. Affected versions ran on Windows and macOS per the October 31 reporting.
The structural finding: Cursor's signed marketplace slot was the trust boundary, and the compromise exploited that trust without Anthropic's own involvement. Cursor confirmed no Anthropic compromise and that versions on official channels were unaffected.
How the Backdoor Worked
The extension planted an attacker's SSH public key (comment "svc-telemetry") into ~/.ssh/authorized_keys and attempted an outbound reverse tunnel to 134.209.82.225. A macOS-specific bug meant systemsetup -getremotelogin required admin privileges, so the script often skipped enabling Remote Login. Despite that, SSH keys were installed and credential metadata leaked on most machines. Persistence broke down by platform: macOS LaunchAgent at com.apple.sysmond.plist plus a ~/.config/.smt script, Linux @reboot cron entries, and Windows SysMon scheduled task or Startup folder script.
- macOS: LaunchAgent +
.smtscript - Linux: cron job at reboot
- Windows: SysMon task or Startup script
- Beacon: HTTP POST on port 8099 (hostname, username, OS, IP, Git email, up to 40 env vars)
What 2.1.314 Fixes and What It Doesn't
Anthropic's clean version 2.1.314 is the recommended removal path, but multiple reports flag it as a partial fix. The backdoor survives a simple uninstall; the authorized_keys entry, LaunchAgent, cron line, and SysMon task don't ride along with a version bump. Reported remediation calls for clearing ~/.ssh/authorized_keys, deleting the startup artifacts, isolating affected machines, and rotating credentials. Cursor also shut its marketplace during the investigation, rotated keys, and reportedly took the attacker's server offline.
As of November 2, the open question isn't whether the patch exists. It's whether the roughly 5,000 potentially affected hosts have actually been cleaned, and which distribution channel (Open VSX versus other marketplaces) the build traveled through. Both remain under investigation.
Comments ()