Malicious versions live October 29, 2026, 2:27 AM to 1:35 PM Pacific; Microsoft analysis October 30, 2026
A Trojanized Claude Code Extension in the Cursor Marketplace Planted an SSH Backdoor on Developer Machines
For about 11 hours on October 29, the Cursor extension marketplace served tampered copies of the Claude Code extension, anthropic.claude-code versions 2.1.312 and 2.1.313, affecting at most 5,000 users who installed or auto-updated on macOS or Windows during the window from 2:27 AM to 1:35 PM Pacific. Microsoft Threat Intelligence analysis, published October 30, confirms the malicious packages were never published through the Microsoft Visual Studio Marketplace or the npm package, that Anthropic systems were not compromised, and that Anthropic did not develop the malicious package; all evidence points to the Cursor marketplace as the only affected channel. The injected loader runs when the extension module loads, before the normal extension code. It collects the hostname, username, operating system, architecture, home directory, working directory, and global Git email, and records the names, not the values, of up to 40 environment variables whose names suggest keys, tokens, secrets, or cloud credentials. It then appends an attacker-controlled SSH public key labeled svc-telemetry to the user authorized_keys file, attempts to enable the local SSH service, opens a reverse SSH tunnel so the workstation can be reached through the attacker server, and writes platform persistence: a LaunchAgent on macOS, a crontab entry on Linux, and a scheduled task with a Startup folder fallback on Windows. Cursor removed the versions, shut down its whole marketplace, audited other extensions, rotated its keys, and rebuilt the marketplace. Cursor reports that permission requirements blocked actual SSH logins on most macOS and Windows hosts, but Microsoft stresses that the key, persistence, and host reporting could still succeed where the login failed, and that removing or updating the extension does not remove artifacts written outside the extension directory. A clean version, 2.1.314, has been published.
Executives
Developer workstations hold source code, cloud credentials, and signing keys, which is why an 11-hour window in one marketplace matters beyond its 5,000-user ceiling. The governance point is provenance: the same extension name from a different marketplace is a different trust decision, and auto-update turned that decision into silent exposure. Ask which editor marketplaces your teams are allowed to install from, and whether anyone can name the workstations that updated developer tooling on October 29.
CIO / CISO
Scope by channel and timestamp first: only installs or auto-updates of anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace in the October 29 window are in scope; Visual Studio Marketplace and npm installs are not, per Microsoft. For in-scope machines, preserve the extension package, the authorized_keys file, and the persistence artifacts before cleanup, then rotate credentials and revoke sessions where telemetry shows loader execution, working from a known-clean device. Adopt the hardening Microsoft points to, including restricting extensions to approved publishers and using an installation cooldown for newly published versions.
Engineers
Check for the artifacts, not just the extension version: search authorized_keys on macOS and Linux, and both the user file and the administrators file on Windows, for the svc-telemetry key and confirm it against the fingerprint Cursor published before removing that exact entry and no others. Then clear the persistence by platform: the com.apple.sysmond LaunchAgent and the .smt and .smtk files under .config on macOS, the crontab reboot entry on Linux, and the SysMon scheduled task, the Startup folder sysmon.cmd, and the .config smt files on Windows, and stop any reverse SSH retry processes. Verify after a restart that nothing returns.
Everyone (non-IT)
If you use Cursor and installed or updated the Claude Code extension on October 29, do not just update and move on: follow your IT team instructions or Cursor remediation steps, because the backdoor files live outside the extension itself. If you installed Claude Code from the Microsoft marketplace or npm, Microsoft confirms those copies were not affected.