Updating the Claude Code extension in Cursor does not remove the backdoor it may have planted.

What happened

On Oct 29, between about 2:27 am and 1:35 pm PT, Cursor’s extension marketplace served tampered Windows and macOS builds of anthropic.claude-code, versions 2.1.312 and 2.1.313. Cursor says they were not developed by Anthropic. Microsoft says the evidence points to the Cursor marketplace only; the VS Code Marketplace and npm packages were not affected.

What the injected code does as soon as the extension loads:

  • Profiles the host: hostname, username, Git email, and the names (not values) of environment variables that look like keys or tokens
  • Adds an SSH key labeled svc-telemetry to authorized_keys
  • Opens a reverse SSH tunnel to attacker infrastructure and retries about every 60 seconds
  • Persists through a LaunchAgent on macOS, or a “SysMon” scheduled task or Startup-folder script on Windows

Two things matter for triage

  1. Removing or updating the extension doesn’t remove what it wrote outside its own folder.
  2. A tunnel is not a confirmed login. The attacker also needs the local SSH service to be running. Treat hits as leads, then confirm.

What to check now

  • Endpoints with 2.1.312 or 2.1.313 installed from the Cursor marketplace (confirm source and hash, not just the version)
  • svc-telemetry in authorized_keys
  • ssh or autossh processes with -R to 134.209.82[.]225
  • macOS: com.apple.sysmond.plist, ~/.config/.smt and .smtk. Windows: the SysMon scheduled task, smt.cmd, or sysmon.cmd in Startup

Preserve evidence, isolate, clean up, then rotate credentials reachable from affected hosts.

The bigger lesson

A trusted publisher name in a mainstream marketplace was the delivery path. Developer laptops need an inventory of the AI extensions actually installed, and detection for what they do after install.

In Netra, AI BoM lists AI extensions by version, source and publisher, and endpoint alerts flag SSH reverse tunnels with the full command line, process and parent process. (Screenshots from our demo environment.)

Netra AI BoM view listing an Anthropic Claude Code VS Code extension with its version, source, publisher and operating system.

Netra endpoint alert details for an SSH reverse tunnel, rated High under the Command and Control tactic, showing the ssh -R command line and parent process.

Cursor’s advisory has the full IOC list and remediation scripts.