Trojanized Claude Code Extension Planted an SSH Backdoor

On October 29, between 2:27am and 1:35pm Pacific time, Cursor offered malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension. The package appeared as a legitimate update from a verified account, and Ars Technica reports that as many as 5,000 users may have been affected.

The update added an SSH key and a 60-second retry loop

The malicious code collected the hostname, username, operating system, architecture, home path, environment variable names, working directories, configured Git email and public IP address. It reported those details to an attacker server.

It also appended a public key labeled svc-telemetry to authorized_keys, tried to enable the local SSH service and opened a reverse SSH tunnel. On macOS it created a LaunchAgent. On Windows it used a scheduled task or a startup-script fallback. Helper processes retried the connection roughly every 60 seconds.

Cursor removed the malicious releases, temporarily shut down the marketplace, rotated keys and worked with the hosting provider to disable the command server. The company says its audit found no impact on other versions or extensions.

A developer extension runs beside source code and credentials

An editor extension can reach working directories and runs with the permissions of the IDE. The attacker did not need to compromise the Claude model itself. Getting code into a trusted distribution channel was enough, especially when extensions can update automatically.

Environment variable names do not reveal their values, but they tell an operator which machine may hold valuable cloud credentials or API tokens. A working SSH tunnel could then expose files, repositories and other credentials available to that user.

The incident separates product security from distribution security. Official source code can remain clean while a verified account and marketplace form another link in the chain. That link failed here, and neither Cursor nor Anthropic has publicly explained how the account was taken over.

Malware bugs limited access but did not undo installation

Enabling an SSH service usually requires administrator rights. Cursor therefore says the attempt to establish a fully functional tunnel failed on most macOS and Windows machines. The command server is also offline. Those facts reduce the chance of remote access, but they do not reverse changes already made on disk.

The package could still add the unauthorized key, install standalone persistence scripts and send a profile of the host. Installing safe version 2.1.314 or uninstalling the extension does not automatically remove those artifacts. Cursor advises searching for the svc-telemetry key, isolating affected hosts and rotating credentials from a trusted machine.

The account-takeover explanation will decide marketplace trust

The crucial missing fact is how the attacker reached the verified distribution account. Without it, defenders cannot tell whether key rotation closes the problem or whether the same weakness could affect other publishers. Cursor has described the payload and endpoint remediation more clearly than the origin of the compromise.

The next useful numbers are exact installation counts, confirmed payload executions and successful connections. Organizations should meanwhile monitor extension installations like new production dependencies. A marketplace badge confirms the publisher shown in the interface, not the safety of every update.

Lilith's verdict

The verified badge held the door while an automatic update carried in an attacker's SSH key. A marketplace that cannot explain the account takeover is selling trust without a receipt.