A Fake Claude Code Extension Sat in Cursor's Marketplace for 11 Hours. Uninstalling It Does Not Remove the Backdoor. Here's the 3-Minute Check.
Between about 09:27 and 20:35 UTC on October 29, a malicious build of the Claude Code extension (version 2.1.313) was available in Cursor's extension marketplace. Reports citing Cursor say up to 5,000 users may have received it. Cursor's own notice says the build "was not developed by Anthropic," and removing the extension afterward does not remove what it left behind.
If you code in Cursor, Windsurf, or any editor that pulls from Open VSX, run the check below before you read the rest.
The 3-minute check
On macOS or Linux, look for the attacker's key:
grep svc-telemetry ~/.ssh/authorized_keys
If that prints a line, treat the machine as compromised. On Windows, Cursor says to check $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the same svc-telemetry label.
No output is good news, but not proof. Cursor's notice lists versions 2.1.312 and 2.1.313 as affected, while StepSecurity's analysis found only 2.1.313 malicious and 2.1.312 clean. I'd check your extension history for both versions and not argue about which one is right.
What the extension did
According to StepSecurity's analysis, the loader ran as soon as the module loaded, with no Claude conversation needed. It added an SSH key to authorized_keys, set up persistence (a LaunchAgent on macOS, a scheduled task on Windows, cron @reboot entries on Linux), and tried to open a reverse SSH tunnel to a server at 134.209.82.225. It also sent a beacon over plain HTTP that included the names of environment variables matching words like KEY, TOKEN, SECRET, and AWS.
Two details matter for how worried you should be. Cursor says the SSH and tunnel steps would usually fail without admin rights, and Sophos, citing Phorion's analysis, reports that coding errors made SSH enablement fail on most macOS and Windows hosts. That lowers the odds of a live remote session. It does not lower the odds that your environment variable names, and possibly more, went out in the beacon.
The extension was distributed through Open VSX, which Cursor and Windsurf rely on. Help Net Security reports that Microsoft's Visual Studio Marketplace never carried it. Nobody has publicly said how the build got into the registry under the legitimate Anthropic namespace. Anthropic shipped a clean 2.1.314 on October 30 and the attacker's server has been taken offline, per Cursor.
If the check finds something
Cursor published remediation scripts for macOS and Windows that remove the extension, persistence, tunnel processes, and the key. Run the script as the affected user, not as root. Then do the part the script cannot do: rotate every credential that machine could reach, from a different, known-clean computer.
For a solo operator that list is short but painful. Your GitHub token, your cloud provider keys, your registry tokens, the SSH key to your production box, and anything sitting in a .env file or shell profile. StepSecurity goes further and recommends rebuilding the host if the tunnel connected. I agree. A laptop you cannot fully account for is not worth the afternoon you'd spend trying.
The habit that would have limited this
I'd stop treating my editor machine as the place where production secrets live. Three changes cost almost nothing.
First, keep long-lived tokens out of environment variables in your shell profile. Use short-lived credentials from your cloud CLI or a secrets manager that prompts you. A beacon that lists variable names is much less useful when the variables are empty.
Second, give your production SSH key a passphrase and load it into an agent that asks for confirmation. A key sitting unencrypted in ~/.ssh is what a payload like this is built to find.
Third, delay extension updates. VS Code-based editors have an extension auto-update setting, and switching it to manual means you pick the day you update. This build was live for roughly 11 hours. A one-day delay would have skipped it entirely.
Where this advice could be wrong
Delaying updates has a real cost: you also delay security patches in the extensions you do trust, and you now have a chore to remember. If you only run two or three extensions from major publishers, the trade may not be worth it. The point of this incident is narrower. The publisher name on the listing was legitimate and the build still was not, so a trusted publisher is not a security control.
What I'd actually do today
Run the grep. Check your installed extension version history. If you use Claude Code through the terminal CLI instead of the editor extension, this specific build did not touch you, but the same reasoning about secrets applies. Then spend 20 minutes moving one long-lived token out of your shell profile this weekend. That is the change that pays off the next time this happens, and there will be a next time.
Author
Lukas
@lukcombinator