AW Dev Rethought Flash: Claude Code’s Cursor Extension Was Backdoored for 12 Hours

On 29 October, a malicious build of Anthropic’s Claude Code extension was published to the Cursor marketplace under the legitimate anthropic.claude-code extension ID. It was live for close to twelve hours before removal.

The scope matters, because the headlines are wider than the incident. Only version 2.1.313, and only on the Cursor marketplace. Open VSX, Microsoft’s Visual Studio Marketplace and the npm package were all unaffected, per Socket and Microsoft. The clean release is 2.1.314. Cursor says at most 5,000 users installed during the window, roughly 2:27am to 1:35pm Pacific.

Anthropic states its own systems and employee laptops were not compromised, and that someone used access to Cursor’s marketplace to publish the tampered build. Cursor says the exact publishing method is still unclear.

What that build did to developer machines is worth reading carefully, because the cleanup is not what most people will assume.

What Was in the Bundle

A 66-line loader, inserted ahead of the legitimate extension code in the main JavaScript bundle. It runs when the extension module loads — after editor startup, and again whenever the webview opens.

Three things happen. An attacker-controlled SSH key is written into ~/.ssh/authorized_keys, labelled svc-telemetry so that anyone scanning the file reads it as infrastructure plumbing and moves on. The loader attempts to enable the local SSH service, with platform-specific paths for Windows, Linux and macOS. And it opens a reverse SSH tunnel to 134.209.82.225.

Then it establishes persistence appropriate to the host: a scheduled task on Windows, a crontab entry on Linux, a LaunchAgent on macOS.

Cursor’s assessment is that enabling the SSH service usually requires administrator rights the extension does not have on most macOS and Windows machines, so the tunnel login likely failed in many cases. That is genuine mitigation and it is also the least important sentence in this post, because the key and the persistence entries were written regardless.

It Took Names, Not Values

The loader beacons to /beacon on port 8099 at the same IP, over unencrypted HTTP. It sends public IP, hostname, local username, OS and CPU architecture, home and current working directories, and the global Git email.

And then the part worth pausing on: the names, not the values, of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.

It took the names of your secrets, not the secrets. That is a shopping list, not a theft.

This is a deliberate design decision and it tells you something about the operator. Exfiltrating actual credentials is noisy, bulky and likely to trip detection. Exfiltrating variable names is small, cheap, and tells you precisely which of five thousand machines belongs to someone with production AWS access versus someone running a hobby project.

It is target selection for a later stage. Which means whoever did this was not expecting to be finished in twelve hours — they expected to come back. No follow-on payloads have been observed, which is reassuring about what happened and says nothing about what was planned.

Uninstalling Does Not Clean It

This is the operative part of the whole incident, and it is the part most coverage buries.

Removing the extension removes the extension. It does not remove the key.

Everything the loader wrote lives outside the extension’s install directory. Uninstalling, or updating to 2.1.314, leaves all of it in place. A developer who heard about this, removed the extension and considered the matter closed still has an attacker’s public key authorised on their machine right now.

If you or anyone on your team installed Claude Code on Cursor on 29 October, check three places.

~/.ssh/authorized_keys, for any entry you did not add — specifically one labelled svc-telemetry, though an operator who reads this post will pick a different label next time, so review every key rather than searching for that string.

Your platform’s persistence location: scheduled tasks on Windows, crontab -l on Linux, ~/Library/LaunchAgentson macOS.

And your SSH service state, since the loader attempted to enable it. If sshd is running on a laptop where you never turned it on, that is the finding.

Microsoft’s guidance is to identify affected hosts, preserve evidence before cleaning, and isolate them. If you care about knowing what happened rather than just making it stop, capture the artifacts before you delete them. Then rotate credentials and revoke active sessions — not because secrets were confirmed stolen, but because the machine advertised which ones were worth taking.

Nobody Has Explained How It Got There

The most uncomfortable fact about this incident is the one nobody can answer yet.

The malicious build carried the legitimate extension ID. It was not a typosquat, not a lookalike with a transposed character, not a package a careless developer picked from search results. It was the official extension, under the official publisher identity, served by the marketplace.

Cursor has rotated its keys, rebuilt the marketplace, had the hosting provider take the attacker’s server offline, and says it will contact affected users directly. All of that is the right response. None of it explains how the tampered artifact was published in the first place, and until that is public, the honest position is that the trust model which failed here has not been shown to be fixed.

Twice in One Week

This is the second supply chain incident in seven days where the delivery mechanism was the developer toolchain itself. Earlier in the week it was repositories arming AI coding agent configuration files to execute on open. Now it is an editor marketplace serving a backdoored official extension.

Neither exploited a software vulnerability. Both used the distribution and configuration systems exactly as designed.

That is the pattern worth taking from this. We have spent a decade hardening what runs in production and comparatively little on what runs on the machines that build it — machines holding cloud credentials, signing keys, CI tokens and source code, running editors that execute third-party code on startup and auto-update themselves overnight.

An attacker who wants production access no longer needs to attack production. They can attack the editor.