Trojanized Claude Code Extension Hit Cursor's Marketplace, Affecting Up to 5,000 Developers

What happened

The tampered build was nearly identical to the official extension, except for a loader of about 7 KB embedded at the start of extension.js; it executed as soon as the extension module loaded, with no conversation needed and no package-manager lifecycle hooks involved.

The loader collected the hostname, username, operating system, architecture, home directory, Git email and public IP address, swept environment variable names matching KEY, TOKEN, SECRET, PASS, AWS or GCP patterns, and sent them over plain HTTP to 134.209.82.225:8099; it then added an attacker SSH key labelled svc-telemetry to authorized_keys, tried to enable the local SSH service and opened a reverse tunnel, retrying roughly every 60 seconds.

Cursor removed the affected versions at 20:35 UTC on October 29 and took its entire extension marketplace offline for audit, rotating keys and rebuilding the service before restoring it; the attacker server has since been taken offline with the hosting provider's cooperation, and the audit found no other tampered extensions. Anthropic said its own systems and employee laptops were not compromised, the tampered build was not its release, version 2.1.313 never appeared on Open-VSX, the Microsoft Visual Studio Marketplace or npm, and clean version 2.1.314 was published at 01:07 UTC on October 30.

Key facts

1. Exposure window: From about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29 (09:27–20:35 UTC), Cursor's extension marketplace served tampered anthropic.claude-code builds 2.1.312 and 2.1.313 for macOS and Windows
2. Scale: Cursor says at most 5,000 users received the tampered build and plans to contact affected users directly
3. Payload: On load, the extension collected host details and environment variable names and sent them out, planted the svc-telemetry key and opened a reverse tunnel; persistence used the com.apple.sysmond LaunchAgent on macOS, the SysMon scheduled task and Startup script on Windows, and an @reboot cron entry on Linux
4. Backdoor did not open: Enabling the local SSH service requires administrator privileges and the malicious code had defects, so the tunnel failed on most affected machines; but the key and persistence scripts still landed on disk, and neither uninstalling the extension nor upgrading to 2.1.314 removes them
5. Response: Cursor pulled the tampered builds and took the marketplace fully offline for audit, rotated keys and rebuilt the service, and the attacker server is offline; the audit found no other tampered extensions
6. Open question: How the attacker published the tampered build under Anthropic's publisher identity on Cursor's marketplace has not been disclosed by either Cursor or Anthropic