A coding assistant is supposed to help write software. For a few hours on October 29, two versions of an extension named Anthropic.claude-code in Cursor’s marketplace tried to do something very different: quietly prepare developers’ computers for remote access.
Cursor says versions 2.1.312 and 2.1.313, available for macOS and Windows, had been maliciously modified and were not made by Anthropic. The altered extension gathered information about each computer and attempted to install an SSH backdoor—a route that could let an attacker connect remotely.
The incident is a reminder that a software extension is not just a feature that appears inside an editor. It is code running on a real computer, with access to at least some of the environment and files available to the user who installed it.
A quiet foothold, not just a suspicious download
According to Cursor, the extension collected details including the machine’s name, operating system, username, working folders, configured Git email and public IP address. It also gathered the names of environment variables. Those variables can contain clues about a developer’s setup; Cursor said the collection alone did not establish that their values were taken.
The extension then tried to add an attacker-controlled SSH key to the computer’s list of authorized keys, start its local SSH service and open a reverse tunnel to an attacker’s server. Think of the tunnel as a connection initiated from inside the computer and carried outward, potentially creating a path back in.
But an attempted backdoor is not the same as a successful one. Cursor said that, on most affected Mac and Windows machines, enabling the local SSH service would require administrator privileges the extension did not have. Because of that limitation and errors in the malicious code, this step would fail in ordinary circumstances. The company did say the extension added the key, installed persistence mechanisms and sent host details to the attacker.
Persistence is the part that makes a malicious program more than a one-time intrusion attempt. The code tried to set up background tasks that would retry the tunnel about every minute, using different mechanisms on macOS and Windows. That is why simply removing the extension may not clean an affected computer: the dropped scripts could continue running on their own.
The trust problem hiding in the extension store
Cursor says the altered versions were available from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It removed them, temporarily shut down its marketplace as a precaution, audited access, rotated keys and rebuilt the marketplace. It also worked with the server’s hosting provider to take the attacker’s server offline. The company said it had no evidence that other versions of the extension or Anthropic’s official distribution were affected.
That distinction matters. A familiar name can make an extension seem trustworthy, but the name displayed in a marketplace is not proof of who created every package bearing it. Software supply chains—the systems and services through which code is built, distributed and updated—create convenience, but also additional points where trust can be abused.
For developers, that risk can have consequences beyond a single application. Their machines may contain source code, access tokens or credentials for company systems. The incident does not show that those materials were stolen, but it helps explain why security teams treat unexpected code execution on a developer’s computer seriously.
What affected users should do
Cursor advised anyone who installed either version from its marketplace during the exposure window to check for an unauthorized SSH key marked “svc-telemetry.” A match is evidence that the machine was affected. The company also published platform-specific remediation scripts intended to remove the key, malicious extension, tunnel processes and persistence mechanisms.
Users who find signs of the payload should isolate the computer, investigate it and consider whether it needs to be rebuilt. Cursor also recommends rotating credentials and sessions accessible from an affected machine, using a trusted system. The attacker’s server is no longer functioning, but that does not by itself erase changes already made to a computer.
Extension stores make powerful tools easy to install—and that same ease can make a compromised package consequential. The useful question is not only whether an extension is popular or familiar, but what it can do once it is running on your machine.