How the fake Claude Code extension on Cursor broke itself
Key takeaways
- A maliciously modified copy of Anthropic's Claude Code extension, version 2.1.313, was live on Cursor's marketplace for approximately 11 hours on October 29, and Cursor said up to 5,000 users were affected.
- The attackers put a JavaScript loader at the start of extension.js and left the legitimate code unchanged, per BleepingComputer, so the extension kept working and a normal-seeming tool proves nothing.
- The SSH backdoor broke on attacker bugs, per BleepingComputer: a macOS command that needed admin rights, and a Windows step that called PowerShell through /bin/sh.
- Collecting host and user details is a different action from planting an SSH key, so a failed backdoor doesn't tell you nothing was gathered.
- If you installed the extension during the window, check for an SSH key named svc-telemetry.
What happened with the fake Claude Code extension on Cursor?
On Thursday, October 29, a maliciously modified copy of Anthropic's Claude Code extension was distributed through Cursor's marketplace for approximately 11 hours, according to BleepingComputer. GDN Online, reporting Cursor's statement, gives the window as about 2:27 a.m. PT to 1:35 p.m. PT. The tampered package used the version number 2.1.313.
Cursor said the modified extension affected up to 5,000 users, and that Anthropic did not develop it. So this was a modified copy carrying Claude Code's name, not something Anthropic shipped.
Cursor's wording is "up to," so read the figure as an upper bound on exposure. It isn't a count of compromised machines.
How did the malicious extension hide inside the real code?
Per BleepingComputer, the attackers inserted a malicious JavaScript loader at the very beginning of the extension's extension.js file and left the legitimate code otherwise unchanged.
That placement is clever in a boring way. Code at the top of a file runs before everything below it, so the loader gets its turn first, and then the genuine Claude Code extension loads and behaves the way users expect. There's no second, obviously suspicious tool to spot, because the real one is still in there doing its job.
This is why "it seemed fine" is useless as evidence. An extension that works normally can still be the compromised one. The signals worth trusting are the version, the install window and what's actually on your machine.
What did the extension try to collect?
The reports describe this step a little differently, so we'll keep them apart. Tecnoblog reports that after installation the malware collected the username, PC name, operating system, processor architecture, working directories, Git email and IP address. GDN Online says the extension attempted to collect host and user information, including hostname, username, operating system and public IP address.
"Collected" and "attempted to collect" aren't the same claim, and we can't settle the difference from the published reporting, so we won't say outright that data left any machine. Each description covers who you are, what machine you're on and where you're connecting from. Tecnoblog's list adds your Git email and working directories, which say a bit more about you and your projects.
Collecting host and user details is a different action from planting an SSH key. One reads information, the other changes the machine. That's why the next section's failures don't automatically settle this one.
- Tecnoblog's list: username, PC name, operating system, processor architecture, working directories, Git email, IP address
- GDN Online's list: hostname, username, operating system, public IP address
What was the SSH backdoor supposed to do?
According to Tecnoblog, the malware tried to add an attacker-controlled SSH key named svc-telemetry to the computer and used it for a reverse tunnel to an external server. The name reads like routine monitoring software, the kind of label you'd scroll past.
A reverse tunnel is a connection your machine opens outward to a server the attacker controls. Because it starts from the inside, it can get around the usual rule of blocking unsolicited inbound traffic. Once it's up, whoever runs the server can reach back toward your machine. GDN Online describes the same goal in general terms: the extension attempted to set up remote access for the attacker.
That's the part that would have turned a data grab into ongoing access. It's also the part that broke.
Why did the SSH backdoor fail on macOS and Windows?
BleepingComputer reports a different attacker mistake on each platform.
On macOS, the malware ran systemsetup -getremotelogin without elevated privileges. That command checks the status of Remote Login, which is how macOS switches its SSH server on and off. Without admin rights it returned an administrator-access error, and the SSH enable step was skipped.
On Windows, the OpenSSH setup failed because the malware invoked PowerShell through /bin/sh. That's a Unix shell, and it isn't present on standard Windows installations. The command was written for the wrong operating system.
Cursor's own summary matches the pattern. According to Tecnoblog, Cursor said the attack mostly failed because the code had errors and needed elevated permissions, and that risk was higher only on machines where admin or root permissions had been given to Cursor. GDN Online also reports that a key step would have failed on most machines because it requires administrator rights.
We're making no claim about Linux either way.
- macOS: systemsetup -getremotelogin ran without admin rights, errored, and the SSH enable step was skipped (BleepingComputer)
- Windows: PowerShell was launched through /bin/sh, which standard Windows lacks, so the OpenSSH setup failed (BleepingComputer)
- Cursor: mostly failed on code errors and missing permissions; higher risk where Cursor had admin or root rights (via Tecnoblog)
Does a failed backdoor mean you can stop worrying?
Not automatically. The SSH bugs are reported against the svc-telemetry key and the tunnel. The host and user details are a separate question: Tecnoblog says they were collected, and GDN Online says the extension attempted to collect them.
Some things we won't guess at. We won't speculate about how the modified package got onto the marketplace or who made it.
On scope, Cursor said the incident did not impact other extensions on its marketplace, and Tecnoblog reports that Cursor says there is no evidence of tampering in other packages. That's Cursor's statement.
Here's our opinion, and it's labeled as one: don't run your editor with admin or root rights. Per Cursor, the risk was higher only where those permissions had been given to Cursor, and both SSH failures traced back to missing permissions or the wrong platform. Running with elevated rights removes the accident that protected most people here. If you're curious how we think about building and shipping software, our process page lays it out.
What's the one check to run?
BleepingComputer's advice is specific: users who downloaded the package during the window should check for an svc-telemetry SSH key. The window ran from about 2:27 a.m. PT to 1:35 p.m. PT on October 29, and the bad version was 2.1.313.
SSH keys that allow logins normally live in the authorized_keys file inside your .ssh folder, so that's where we'd start, and we'd search the folder for the name svc-telemetry. Finding nothing is good news about the SSH step. It doesn't answer whether host and user details left your machine, since collecting them was a separate action.
If you installed during the window, look for svc-telemetry.
Frequently asked questions
Was I affected by the fake Claude Code extension on Cursor?
You could only have been exposed if you downloaded version 2.1.313 during the roughly 11-hour window on October 29, about 2:27 a.m. PT to 1:35 p.m. PT. Cursor said up to 5,000 users were affected, which is a ceiling on exposure, not a count of compromised machines. If you installed in that window, check for an svc-telemetry SSH key.
Did Anthropic make the malicious Claude Code extension?
No. Cursor said the extension was not developed by Anthropic. It was a maliciously modified copy of Anthropic's Claude Code extension, distributed through Cursor's marketplace. We won't speculate about how it got published or who made it, because we have no sourced facts on either.
Why did the SSH backdoor fail on Mac and Windows?
BleepingComputer reports a different attacker bug on each platform. On macOS, the malware ran systemsetup -getremotelogin without admin rights, got an error and skipped the SSH step. On Windows, it launched PowerShell through /bin/sh, which standard Windows installs don't have. Cursor says the attack mostly failed on code errors and missing permissions.
Did the extension steal any data even though the backdoor failed?
The sources differ. Tecnoblog says the malware collected username, PC name, operating system, processor architecture, working directories, Git email and IP address. GDN Online says it attempted to collect host and user information. Gathering that data is a different action from planting the SSH key, so a failed backdoor doesn't settle it.
Were other Cursor marketplace extensions affected?
Cursor said the incident did not impact other extensions on its marketplace, and Tecnoblog reports that Cursor says there's no evidence of tampering in other packages. That's Cursor's own statement. The sourced action for this incident is checking for the svc-telemetry SSH key if you installed the extension during the window.