A Fake Claude Code 2.1.313 Planted SSH Keys on Up to 5,000 Cursor Users
Software / news
A Fake Claude Code 2.1.313 Planted SSH Keys on Up to 5,000 Cursor Users
Cursor, Phorion, StepSecurity and Socket agree on the payload. They disagree on whether the build ever touched Open VSX or npm.
Cursor said a maliciously modified build of Anthropic's Claude Code extension, labelled version 2.1.313, was available in its extension marketplace on October 29. At most 5,000 users received it, according to Cursor's security notice, and Cursor says it will contact them directly.
The notice says the extension "was not developed by Anthropic". It does not say how the build reached the marketplace, and none of the four write-ups read for this story supplies that answer.
What the 2.1.313 build did on install
Phorion, a macOS endpoint security vendor, published the most detailed teardown on October 30. Its author is Calum Hall. The injected code sits in front of extension.js and runs the moment Node loads the file, before the extension's activate function, so no click and no Claude session is needed.
Phorion lists four stages. The code appends an Ed25519 key with the comment svc-telemetry to the user's authorized_keys file, opens a reverse SSH tunnel to 134.209.82.225 as user "tunnel", installs persistence, and sends a one-time HTTP beacon to port 8099 carrying hostname, user, OS, git email and public IP. It also sends the names, not the values, of environment variables matching key, token, secret, pass, AWS or GCP.
Persistence differs by system: a LaunchAgent called com.apple.sysmond on macOS, an @reboot cron entry on Linux, and a scheduled task named SysMon or a Startup script on Windows.
Phorion also found a flaw in the attacker's macOS code. The script checks Remote Login with systemsetup -getremotelogin, which prints an administrator-access error and exits with status 0 when run without admin rights. The script looks only for the word "Off" in the output, so it never tries to switch SSH on. On a Mac where Remote Login was already off, the tunnel therefore has nothing to reach, though the key and the LaunchAgent are still installed.
Timeline and exposure
| Date (UTC) | Event | Source |
|---|---|---|
| Oct 27, 20:26 | Clean 2.1.312 published to Open VSX | StepSecurity |
| Oct 29, about 09:27 | 2.1.313 live (Cursor: 2:27am PT) | Cursor, StepSecurity |
| Oct 29, 20:35 | Version removed (Cursor: 1:35pm PT) | Cursor, StepSecurity |
| Oct 30, 00:12 | 2.1.314 appears in npm record | Socket |
That is a window of about 11 hours. Cursor says it took its VS Code marketplace offline, audited access, found no other tampered extensions, rotated keys, rebuilt the marketplace and worked with the hosting provider to shut down the attacker's server.
Where the sources disagree
StepSecurity, whose post is by Rohan Prabhu, says the build appeared under the legitimate Anthropic namespace on Open VSX and reached Cursor through its mirror. It says the version has since been purged.
Socket reads the same registry differently. Its review of 3,392 Open VSX change-feed events, the latest at 05:35 UTC on October 30, shows events for 2.1.312 and 2.1.314 and none for 2.1.313. Socket also found no 2.1.313 in npm's version and time records or in the GitHub releases, and says the original Open VSX attribution was revised after Cursor's notice. Socket says it has not obtained the artifact, and that "the provenance of the analyzed directory is not established".
Phorion adds a third claim: that Cursor pulled 2.1.313 from npm and VS Code registries too. Cursor's own notice names only its marketplace. This story treats the marketplace as confirmed and the other channels as disputed.
What to check now
Cursor's notice and StepSecurity give the same first test: search authorized_keys for svc-telemetry. Cursor supplies a bash script for macOS, to be run as the affected user and not root, and a PowerShell script for Windows, to be run as Administrator.
Cursor says "uninstalling the extension may not be sufficient", and Phorion is blunter that removing the extension alone will not remove the backdoor. Both advise rotating credentials reachable from the machine. StepSecurity adds that if the tunnel connected, rebuilding the host is safer than cleaning it.
Clean builds are 2.1.312 and 2.1.314, which StepSecurity verified on Open VSX. Cursor has not said when it will finish contacting affected users, and no account yet explains how the modified package was published. Anthropic has issued no statement in any of the pages read here. For related reading on the tool itself, see our look at a Claude Code summary-agent spend issue and the skills framework that spread across 16 harnesses.
Sources
More in Software
- 01Python 3.15 Ships a Built-In sentinel After Five Years of PEP 661The new type replaces the object() idiom with a one-line constructor that survives copying, pickling and type checking, but a Python 3.15 floor is the price of using it.
- 02Lightpanda 1.0 Passes 80% of Chrome's Web Tests, by Its Own CountThe Zig-built headless browser left beta on Oct. 2, and its own benchmarks put it ahead of two Rust rivals on a 940-page crawl, with no hardware listed.
- 03Claude-Mem Hits 107,900 Stars, and Its Own Pages Disagree on LicenceThe Claude Code memory plugin has gained about 35,500 stars since May, but a May write-up says AGPL-3.0, the repository now says Apache-2.0, and the README describes an optional cloud sync that earlier coverage did not.
- 04Jepsen Found 96 Issues in ParticleDB 1.1.4 and Tells Users to Halt DeploymentKyle Kingsbury’s 31 October report, funded by vendor Orkes, finds lost writes and ignored constraints in healthy single-node runs.