Malicious Claude Code extension on Cursor marketplace planted SSH backdoors
Severity: high · Patch status: no-fix-needed · Since 2026-10-30
On October 29, 2026, a maliciously modified version of Anthropic's Claude Code VS Code extension (v2.1.313) was published on Cursor's extension marketplace for roughly 11 hours (2:27 a.m.–1:35 p.m. PT), exposing up to 5,000 developers. The extension's extension.js contained a JavaScript loader that ran on load, collecting system info, Git email and public IP, adding an attacker-controlled SSH key ('svc-telemetry'), enabling persistence via macOS LaunchAgent or Windows scheduled task, and opening a reverse tunnel to 134.209.82[.]225. Coding errors meant SSH was often not enabled, limiting remote access, but reconnaissance data was still exfiltrated. Cursor removed the extension, shut down and audited the marketplace, rotated keys, and took down the attacker server. How attackers published under Anthropic's name remains unknown. Affected users should isolate hosts, rotate secrets, and rebuild.
What to do
- Check machines that installed the extension between Oct 29 2:27 a.m. and 1:35 p.m. PT for an 'svc-telemetry' SSH key and follow Cursor's remediation instructions
- Isolate any confirmed-impacted machines immediately
- Rotate all secrets, credentials, and sessions accessible from affected hosts
- Rebuild affected environments from clean backups
- Audit SSH authorized_keys, LaunchAgents/scheduled tasks, and startup scripts on developer machines
Sources
All live incidents on Threat Watch
