Tampered Claude Code Extension Reached Up to 5,000 Cursor Users

A tampered copy of Anthropic’s Claude Code extension was available in Cursor’s VS Code extension marketplace for about 11 hours on October 29. Cursor says it reached at most 5,000 users.

What was affected

Cursor’s security notice names Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS, available between about 2:27 a.m. and 1:35 p.m. Pacific on October 29. Cursor says these malicious versions were not developed by Anthropic, and that other extensions in its marketplace were not affected.

Microsoft, which analyzed the payload, says the malicious packages were never published on the Visual Studio Marketplace or on npm. Anthropic told Microsoft its systems were not compromised, and Anthropic’s Felix Rieseberg wrote on X that it “wasn’t a compromise of Anthropic’s systems or employee laptops.” Neither company has said how the attacker got access to publish in Cursor’s marketplace.

What the extension did

According to Cursor, the extension:

• Collected host and user details such as hostname, username, OS, configured Git email and public IP. Microsoft notes it collected environment-variable names, not their values.
• Added an attacker-controlled SSH key to the user’s authorized keys.
• Installed persistence (a LaunchAgent on macOS, a scheduled task or Startup script on Windows) that retries a reverse SSH tunnel about every 60 seconds.

Enabling the local SSH service needs administrator rights, which the extension didn’t have on most macOS and Windows machines, so on those hosts the tunnel step failed and the attacker couldn’t log in through it. But the key, the persistence scripts and the host-details upload still went through.

What Cursor did

Cursor pulled the malicious versions, shut down and rebuilt its marketplace, rotated its keys, and worked with the hosting provider to take the attacker’s server offline.

How to check

If you installed or updated Claude Code from Cursor’s marketplace on Windows or macOS during that window, Cursor says to look for an SSH key labeled svc-telemetry in your authorized keys file. If it’s there, the machine is impacted. Uninstalling the extension may not be enough, because the payload drops standalone persistence scripts. Cursor’s notice includes remediation scripts and recommends rotating credentials from a trusted system.