# Claude Code on Cursor: the extension with an SSH backdoor

Versions 2.1.312 and 2.1.313 of the Claude Code extension distributed through the Cursor marketplace contained an SSH backdoor. On 29 October they stayed online for about eleven hours and, according to Cursor, reached at most 5,000 users. They were not developed by Anthropic: someone took the real extension and added 66 lines at the top of its main file.

The part that struck me is this: if you installed it, nothing strange happened on your screen. Claude Code worked normally, because it was Claude Code. There was just a guest along for the ride.

It’s like getting a parcel from your usual courier, with the right sender and the right label. Except someone in the warehouse opened it and carefully sealed it back up.

If you’re in a hurry, the commands to check your machine are below.

What happened, and what didn’t

The timeline first, in UTC:

• 29 October, 09:27: the tampered package appears in the Cursor marketplace.
• 29 October, 20:35: Cursor removes it, then shuts down the whole marketplace as a precaution, audits access, rotates its keys and rebuilds it.
• 30 October, 00:12: 2.1.314 ships on npm, followed by Open VSX and the Microsoft marketplace.
• 30 October, morning: the first public warnings arrive, along with Cursor’s security notice. The same day Phorion and Microsoft publish their analyses.
• 30 October, 18:30: Cursor updates its notice, and the affected versions now include 2.1.312.

In the first hours a different version went around, blaming Open VSX (a trace of it survives even in the URL of Phorion’s article). The picture is sharper now, and it’s worth spelling out because you can still read all sorts of things online:

OpenSourceMalware, which analysed the package, corrected its article along these lines. I checked too: npm goes from 2.1.312 to 2.1.314 and 2.1.313 does not even appear in the package history; the official changelog has the same gap and makes no mention of the incident.

What is not known matters just as much: how the package got into the Cursor marketplace, and who is behind it. Cursor told the researchers the extension “experienced some form of compromise”, without saying what kind. Anthropic says an attacker used access to Cursor’s marketplace to publish the package, and confirmed to Microsoft that its own systems were not compromised. What kind of access that was, nobody has explained yet.

What that code did

The 66 lines were placed before the real code in extension.js. According to OpenSourceMalware, the rest of the package was identical to the original. No install scripts were needed and, according to Phorion, not even a click: it was enough for the editor to load the file. Errors were swallowed, so the extension kept looking healthy.

In order:

1. It opened a door. It added an attacker key with the comment svc-telemetry to ~/.ssh/authorized_keys and tried to enable the SSH service.
2. It dug a tunnel. It opened a reverse SSH connection to 134.209.82.225, making your machine reachable even behind a router or a corporate firewall. If the connection dropped, it retried every 60 seconds.
3. It made itself at home. It installed persistence: a LaunchAgent on Mac, a scheduled task on Windows, an @reboot crontab line on Linux. From then on it no longer needed the extension, or even the editor running.
4. It took inventory. It sent the attacker the hostname, user, operating system, folders, Git email, public IP and up to 40 names of environment variables containing words like KEY, TOKEN, SECRET, AWS.

Let me stop on those names for a moment. The malware did not send the values, only the names. It almost looks like good manners, but it’s triage: knowing a machine has AWS_SECRET_ACCESS_KEY tells you which computers are worth entering, out of thousands. The values can be collected later, at leisure, through the tunnel.

The names it picked are also designed to go unnoticed: svc-telemetry looks like a telemetry service, com.apple.sysmond looks like Apple’s, SysMon looks like a Microsoft tool. Anyone glancing at a process list moves on.

Sloppy malware (which is no consolation)

The funny thing is that the code has several bugs. On a Mac, for example, the SSH check runs without admin rights: the command answers with an error but with exit code 0, the script reads that as “SSH already on” and never tries to enable it. On Windows there’s a path that uses /bin/sh. On Linux, again according to Phorion, the crontab check can even wipe the scheduled jobs you already had.

Cursor itself writes that, because of these errors and without admin rights, the tunnel usually doesn’t start. I wouldn’t read that as “all clear”, for two reasons:

• the key and the persistence get installed anyway, and sit there waiting;
• anyone who has already enabled remote login on their Mac, or sshd on Linux, has done the attacker’s work for them. And plenty of developers have.

There is good news too: Cursor says it had the attacker’s server taken offline with the hosting provider’s help. The tunnel shouldn’t lead anywhere today, but a key left in authorized_keys is still a door you never decided to open.

How to check your machine

If you used Cursor with the Claude Code extension during those eleven hours, check even if you’re already on 2.1.314: the update replaces the extension, it doesn’t clean up what the previous version left behind.

On Mac and Linux:

# The attacker's key
grep -s svc-telemetry ~/.ssh/authorized_keys

# Persistence files (the plist only exists on Mac)
ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null

# Affected versions still installed (a 2.1.312 from before 29 October may be clean)
ls -ld ~/.cursor/extensions/anthropic.claude-code-2.1.31[23]* 2>/dev/null

# Active tunnels
ps aux | grep -E '[a]utossh|[s]sh .*-R'

# On Linux: @reboot lines you don't recognise
crontab -l 2>/dev/null | grep '@reboot'

On Windows, in PowerShell:

Select-String svc-telemetry "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" -ErrorAction SilentlyContinue
schtasks /query /tn SysMon
Test-Path "$HOME\.config\smt.cmd"
Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"

The check Cursor suggests only looks for the key in authorized_keys. I’d go through the whole list: it costs nothing. If none of these commands finds anything, and you didn’t install or update the extension from Cursor on 29 October, you can relax.

If you find something

No panic, but no “uninstall and move on” either: removing the extension is not enough, because the persistence scripts keep running on their own. In order:

1. Isolate the machine from the network. If it’s a work computer, tell your security people right away and don’t delete evidence before saving it.
2. Use Cursor’s scripts, remediate-macos.sh (as a normal user, not root) and remediate-windows.ps1 (as administrator), linked from the official notice. They remove the extension, persistence, tunnel and key. On Linux, which has no script, do it by hand: kill the processes, delete the .smt and .smtk files, the crontab line and the key.
3. Check your SSH logs: a login through the tunnel shows up as coming from 127.0.0.1 or ::1, with the svc-telemetry key.
4. Rotate the credentials that user could reach, from another computer: cloud keys, GitHub and npm tokens, SSH keys, active sessions. Start with those whose names ended up in the inventory.
5. Consider reinstalling the machine. At the slightest sign of a login, it’s the only way to sleep at night.

The indicators to look for, on company machines too:

The real problem: a name is not a guarantee

We’ve seen extension attacks before, from GlassWorm (in Italian) onwards, and the software supply chain has already given us a scare with Axios. This time, though, there’s a difference that gives me pause: nobody had to talk you into installing anything. No misspelled name, no cloned page, no phishing email. You had picked the right tool from the right company, the same one many of us keep open all day.

Three things we take too much for granted come into play here.

Anthropic.claude-code is just a label in the catalogue of whoever serves it to you. VS Code forks like Cursor don’t draw from Microsoft’s marketplace: they have their own channel, with their own controls and their own keys. The same name can travel through completely different supply chains, and from the editor you can’t see the difference. When you say “I trust Anthropic”, you’re also trusting whoever sits in the middle. It’s the same conclusion I reached a few days ago writing about DeepSeek’s weights: the most concrete risk isn’t so much in the original as in the copy that reaches you from someone else.

An extension is not an app in a sandbox. It runs with your permissions: it can read your home folder, write to ~/.ssh, start processes. And a coding assistant is installed exactly on that machine, the one with the cloud keys, the tokens and the repository access. It’s hard to imagine a better place for an attacker.

Auto-update works for the attacker. It’s usually a blessing, and after PHP2Shell I’d be the last to tell you to stop updating. But when the poisoned package comes from the official channel, auto-update is exactly the mechanism that carries it into your house while you drink your coffee.

None of these three has a perfect fix, but there are things you can do:

• At work, decide which marketplaces people can install from and keep a list of approved extensions, AI tools included.
• Keep secrets out of environment variables when you can, and out of reach of your development machine. A secrets manager and short-lived credentials limit the damage a lot.
• On sensitive projects, work in a dev container or a virtual machine: an extension in there sees far less than it does on your laptop.
• Keep an eye on authorized_keys and persistence. On a Mac, a tool like BlockBlock or your EDR warns you when a new LaunchAgent appears. A new SSH key you didn’t add is never good news.
• Consider turning off extension auto-update ("extensions.autoUpdate": false) on your most sensitive machines. It’s a trade-off: you’re protected from the first hours of a poisoned package, but then security updates are on you. And if you won’t do them, you’re worse off than before.

In short

• 2.1.312 and 2.1.313 of Anthropic.claude-code in the Cursor marketplace contained an SSH backdoor: online on 29 October from 09:27 to 20:35 UTC, at most 5,000 users.
• Open VSX, the Microsoft marketplace and the npm CLI are not reported as affected. Anthropic says its own systems were not compromised. What access the attacker used, and who they are, is still unknown.
• It installed an attacker key and persistence, and attempted a reverse tunnel. Bugs often break the tunnel, not the rest.
• Updating to 2.1.314 or uninstalling does not clean your machine: check the key, files and processes.
• If you find something: isolate the machine, use Cursor’s scripts, rotate credentials from another computer and consider a reinstall.

Sources: Cursor security notice, Microsoft, Phorion, BankInfoSecurity, OpenSourceMalware, Rescana, versions on Open VSX, npm package, Claude Code changelog.