Cursor has disclosed that a tampered copy of the Claude Code extension, version 2.1.313, sat in its extension marketplace on October 29. Cursor’s security notice says Anthropic did not write it. The malicious version was available from about 2:27am to 1:35pm Pacific time, and Cursor says at most 5,000 users were affected. It says it will contact them directly.

What the extension tried to do

Cursor says the code collected your hostname, username, operating system, home directory path, environment variable names, configured Git email and public IP address. It then tried to add the attacker’s key to your authorized_keys file, the list of keys allowed to log into your computer over SSH (a remote-login protocol). It also tried to open a tunnel back to the attacker and keep it running, retrying roughly every 60 seconds.

Cursor says the login step needs administrator rights that the extension does not have on most Mac and Windows machines, so the attacker likely could not have logged in. The extension would still have added the key, installed its persistence and sent your host details. Cursor says the attacker’s server is now offline, and it has no evidence that other versions of the extension are affected.

How to check your machine

If you installed or updated Claude Code inside Cursor on October 29, check your machine. On a Mac, Cursor gives this command, which succeeds silently if the attacker’s key is present:

grep -qs svc-telemetry ~/.ssh/authorized_keys

On Windows, search your authorized_keys files for svc-telemetry in PowerShell. If you find it, Cursor says to take the machine off the network, remove the key and the persistence files with its remediation scripts, and rotate every credential and session the machine could reach. Do the rotation from a different, trusted computer. Cursor also says to decide whether the machine needs a full rebuild. The scripts and the full file list are in the notice.

Cursor says it removed the version, shut down the marketplace as a precaution, confirmed no other extensions were tampered with, and rotated its keys before bringing the marketplace back.

Cursor has not said how the modified package got into its marketplace, so an extension’s publisher name alone did not guarantee the build came from that publisher.

End of article