A backdoored copy of Claude Code sat in Cursor's extension marketplace for about 11 hours and planted an attacker's SSH key

For about 11 hours on 29 October, anyone who installed or updated Claude Code inside Cursor could get a copy Anthropic never made. It looked like the real thing, and it quietly tried to hand a stranger a key to their machine.

What happened

Tampered builds of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, sat in Cursor's VS Code extension marketplace from about 2:27am to 1:35pm Pacific time. Extra code bolted onto the top of the extension ran the moment Cursor loaded it, no prompt needed. It sent the attacker the machine's hostname, username, public IP, Git email and the names of its environment variables, added an SSH key labelled 'svc-telemetry' to the user's authorized keys, and tried to open a reverse tunnel that retried every minute.

The damage

Cursor says switching on the SSH server needs admin rights, so on most machines the tunnel step failed. The planted key, the persistence scripts and the host report still landed. Security firm Corgea puts the reach at up to 5,000 users. Uninstalling the extension doesn't remove the backdoor scripts.

How it was caught, and what happened next

Cursor pulled the versions, shut its whole marketplace down, rotated its keys, rebuilt it and got the attacker's server taken offline. Microsoft says the official VS Code marketplace and the npm package were never affected, and Anthropic says its own systems weren't breached. Cursor hasn't said how the fake build got in.