Malicious Version of Claude Code Extension Discovered in Cursor Extension Marketplace, Affecting Up to 5,000 Users

On October 30, according to Cursor's official blog, the Cursor VS Code marketplace listed a maliciously tampered version of Anthropic.claude-code 2.1.313 between 2:27 and 13:35 PT on October 29. This version was not developed by Anthropic. It affected up to 5,000 users, and Cursor will contact these users directly. The extension collects information such as hostname, username, and public IP address, and attempts to write the attacker's SSH public key (labeled svc-telemetry), enable local SSH services, and establish reverse tunnels. It also deploys persistence scripts on macOS and Windows.

Since enabling SSH services requires administrator privileges, this step fails on most hosts, preventing attackers from logging in via tunnels. However, key writing, persistence installation, and host information exfiltration still occur. The attacker server at 134.209.82.225 has been taken offline. Cursor has removed this version and temporarily closed the marketplace, while rotating keys, rebuilding the marketplace, and bringing it back online. Currently, there is no evidence that other versions were affected. Cursor advises affected users to check their authorized_keys file for an svc-telemetry key, run the official remediation script, and rotate relevant credentials.