A tampered build of Anthropic's Claude Code extension sat in the Cursor extension marketplace for about 11 hours on 29 October and tried to install a persistent SSH backdoor on developer machines.
What happened
Versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were published to Cursor's marketplace by someone other than Anthropic, between roughly 02:27 and 13:35 Pacific time. Cursor pulled them, shut the marketplace while it audited every other extension, rotated keys and rebuilt it.
The injected JavaScript ran as modules loaded. It collected hostname, username, operating system, architecture, working directory, configured Git email and public IP, then tried to append an attacker SSH key to authorized_keys, enable the local SSH service and open a reverse tunnel, with persistence through a LaunchAgent on macOS or a scheduled task named SysMon on Windows. Background scripts retried the tunnel about every 60 seconds. The attacker's server has since been taken offline.
Enabling the SSH service needs administrator rights, which the extension did not have on most hosts, so the tunnel step failed there. The key, the persistence and the host details still landed, and the report estimates that around 5,000 developer systems may have downloaded the builds.
Who is affected
- Developers who installed or updated the Claude Code extension from Cursor's marketplace on 29 October.
- Windows and macOS workstations used for software development, which usually hold source code, cloud tokens and SSH keys.
- Anyone who assumes a marketplace listing implies the vendor built it. Anthropic's official channels and other marketplaces were not involved.
What to do now
Hunt for the SSH key comment svc-telemetry before assuming nothing happened.
- Check installed extensions for versions 2.1.312 and 2.1.313 and run Cursor's published detection script.
- Search authorized_keys for the ed25519 key commented svc-telemetry, and on Windows look for .config\smt.cmd, .config\smtk, a SysMon scheduled task or a Startup folder sysmon.cmd.
- Look for outbound connections to 134.209.82.225 on TCP 22 or HTTP port 8099.
- Remove the key and persistence, then assess a rebuild. Uninstalling the extension leaves the dropped persistence scripts running.
- Rotate credentials and sessions reachable from an affected host, from a machine you trust.
What this means for South African businesses
Small development teams adopt AI coding assistants faster than they adopt endpoint controls, and few of them can tell you which marketplace an extension came from. That combination is what this attack exploited, and it needs no vulnerability in the editor at all.
My judgement is that the practical risk for a local SME is not the stolen hostname, it is a developer laptop that quietly keeps a tunnel open to an attacker for weeks while holding production cloud credentials.
Source: Cursor - security notice for Anthropic.claude-code 2.1.312 and 2.1.313
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.