A modified copy of the Claude Code extension spent about eleven hours on Cursor’s extension marketplace on 29 October, the company has disclosed. The company says up to 5,000 people were affected and that Anthropic did not build the malicious versions.
The two bad releases were 2.1.312 and 2.1.313, built for Windows and macOS. Anyone who installed or updated to either of them during the window should assume their machine needs cleaning, because simply removing the extension does not undo what it did.
What the code tried to do
Cursor’s security notice says the extension gathered details about the machine and its owner: hostname, username, OS and CPU type, the home folder location, the names of environment variables, the Git email address and the public IP. It then tried to add the attacker’s key to the user’s SSH authorized keys, switch on a local SSH service and open a reverse tunnel, with a background script retrying about every 60 seconds.
Because of a bug in the malware, the tunnel step fails unless Cursor was started with administrator rights, which is rare. Cursor warns that the key, the persistence scripts and the data upload still happened on those machines, so a failed tunnel is not a clean bill of health.
What affected users should do
The malicious package was live from about 2:27 am to 1:35 pm Pacific time on 29 October. Cursor says to remove the unauthorised key (labelled svc-telemetry), the persistence entries and any running tunnel process, consider rebuilding the host, and rotate credentials that the machine could reach. It publishes remediation scripts for macOS and Windows and the file hashes and indicators to check for.
Cursor took the whole marketplace offline as a precaution, worked with providers to neutralise the malware and brought it back once it was satisfied there was no further risk. In a post on X the company said other extensions were not affected and told customers to move to the clean 2.1.314 release of Claude Code for VS Code.
Cursor has not said how the tampered package got into the store. Anyone unsure whether they were hit can check their SSH authorized keys file for the svc-telemetry entry first.
