Cursor's Claude Code Update Planted an SSH Key

Eleven hours, one wrong build

The version number is the whole trap. Anyone who installed or updated the Claude Code extension inside Cursor on October 29, between roughly 2:27 a.m. and 1:35 p.m. Pacific, could have received version 2.1.313 under Anthropic's real extension ID, `anthropic.claude-code`. It was not a lookalike extension with a similar name. It presented as the official update, in the official listing, inside Cursor's own marketplace.

Cursor's notice is blunt about the two things that matter most: the build "was not developed by Anthropic", and at most 5,000 users were affected. How the modified build reached the marketplace is not stated anywhere — not by Cursor, not by the researchers. That gap is worth keeping in view, because it is the difference between a one-off incident and a door that might still be open.

What the 66 lines did

OpenSourceMalware, which analysed the artifact after being tipped off in real time, found the malicious code was small enough to hide in plain sight: a 66-line loader inserted at the top of `extension.js`, ahead of the genuine extension code. The Claude Code binary bundled in the package was the official binary. Only the wrapper had been touched. The loader runs when the extension module loads — at editor startup and when its webview opens — so no prompt, no conversation and no click inside Claude Code is required.

Its sequence is methodical. It collects a host profile: hostname, username, operating system and architecture, home and working directories, the Git email from your global config, and the names of up to 40 environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS or GCP. The values stay home in that first beacon; the names alone are a map of which clouds and CI systems a machine is wired for. It then appends the attacker's Ed25519 key — comment: `svc-telemetry`, chosen to read like an internal service account — to `~/.ssh/authorized_keys`. Next it tries to switch the SSH service on and dials a reverse tunnel home to 134.209.82.225. Background scripts retry the tunnel about every 60 seconds. Host details and backdoor status go out as an unencrypted HTTP POST to port 8099.

Persistence was platform-specific: OpenSourceMalware identified a LaunchAgent named com.apple.sysmond on macOS and a scheduled task called SysMon, with a Startup-folder fallback, on Windows. Its code analysis also identified a Linux crontab persistence branch, although Cursor's published affected-package hashes cover macOS ARM64 and Windows x64.

Two limits keep this from being worse than it is. The loader downloads no second payload; the tunnel is the payload. The initial beacon collected reconnaissance rather than the values of environment variables: it reported names matching KEY, TOKEN, SECRET, PASS, AWS or GCP. That does not establish that credentials were stolen during the initial beacon. But the installed key and persistence mechanisms created a potential subsequent access path, which is why Cursor recommends credential and session rotation from a clean system.

The step that mostly failed, and why you still check

Cursor's own analysis contains the sentence most summaries will skip. Turning on the local SSH service requires admin rights, and the extension does not have them on most macOS and Windows machines. Due to errors in the malicious code, Cursor says, that step "would fail" outside highly unusual circumstances — its example is Cursor started with administrator privileges — and on those machines "the attacker could not have logged in through the tunnel".

Read that precisely. It is a statement about the login step, from the company whose marketplace served the build. It is not a statement that nothing happened. Cursor itself lists what still happened on those machines: the attacker's key was added, persistence was installed, and host details were sent. Its advice that follows is the opposite of reassurance: "Follow the remediation steps below regardless." Uninstalling the extension is not enough either, because the persistence scripts are standalone files that keep running after the extension is gone.

Cursor says the SSH-service activation and login step would fail on most macOS and Windows hosts because it required administrator privileges and the malicious code contained errors. That substantially limited the attack's ability to provide interactive remote access on those systems. Cursor does not say that the key installation, persistence or initial beacon failed; it explicitly says all three still occurred.

What was not compromised

The first reports pointed at the wrong shelves. OpenSourceMalware's initial post and social posts named Open VSX, npm and Microsoft's VS Code Marketplace. The post has since been rewritten: the origin was Cursor's marketplace, and the npm package, the Open VSX extension and the Microsoft VS Code extension are explicitly listed as not malicious.

Socket, which ingests new packages from those registries continuously, checked the records independently. Open VSX's change feed — 3,392 events from October 27, in a feed that retains publication and removal events even for versions live for about 90 seconds — contains 2.1.312 and 2.1.314 and nothing for 2.1.313. The npm time record, which keeps timestamps even for later-unpublished versions, also skips from 2.1.312 (October 27) to 2.1.314 (October 30). A skipped version number alone proves nothing, as Socket notes; other numbers are skipped too.

Socket's registry monitoring found no record of version 2.1.313 in Open VSX or npm, while OpenSourceMalware's updated analysis identifies Cursor's marketplace as the distribution source. Socket also found no corresponding capture in its monitoring of the Microsoft marketplace. Together with Cursor's own confirmation, the evidence supports a narrowly scoped conclusion: the identified malicious build was distributed through Cursor's marketplace, not through the normal npm or Open VSX release channels.

That correction matters beyond tidiness. Teams that went hunting through Open VSX logs on the first reports were looking in a place the malware never was, while the actual check is a single grep on machines that run Cursor.

The check takes ten seconds

If you use Cursor with the Claude Code extension, the test Cursor publishes is one line on macOS — `grep -qs svc-telemetry ~/.ssh/authorized_keys` — with a PowerShell equivalent for Windows covering both the user file and the administrators' file. A hit means the machine is impacted: isolate it, remove the key, the persistence and any tunnel process with Cursor's remediation scripts, assess a rebuild, and rotate credentials and sessions reachable from that machine from a clean system. Cursor says it is contacting affected users directly and has taken the attacker's server offline, which kills the tunnel and the beacon as configured. It does not remove a key that is already sitting in your file.

Auto-update is what made an 11-hour window dangerous: nobody chose version 2.1.313, it arrived the way updates are supposed to arrive. The practical habit this argues for is not refusing updates. It is knowing which of your tools can write to `~/.ssh` — an editor extension runs with your user's full permissions, and this week one of them, briefly, was not yours.

Sources

[1] Cursor, "Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace" (primary — read first-hand: the October 29, 2026 exposure window of about 2:27 a.m.–1:35 p.m. PT, at most 5,000 users affected, the payload steps, the would-fail qualification for the SSH service activation and login step with the administrator-privileges exception, the env-var caveat, marketplace shutdown, audit, key rotation, server takedown, direct outreach, the svc-telemetry check, remediation scripts, IoCs and the darwin-arm64 / win32-x64 package hashes)Read source
[2] OpenSourceMalware, "Trojanized Claude Code Extension Plants an SSH Backdoor", updated Oct 30, 2026 (artifact analysis — the 66-line loader ahead of the legitimate extension code, the official bundled binary, persistence per platform including a Linux crontab branch in the code, IoCs; updated to name the Cursor Marketplace as the origin and to clear the npm package, the Open VSX extension and the Microsoft VS Code extension)Read source
[3] Socket, "Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace", Oct 30, 2026 (independent registry review — 3,392 Open VSX change-feed events from October 27 contain 2.1.312 and 2.1.314 and no event for 2.1.313; the npm time record likewise skips from 2.1.312 on Oct 27 to 2.1.314 on Oct 30; its monitoring captured no 2.1.313 from npm, Open VSX or the VS Code Marketplace)Read source
[4] The Hacker News, "Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor", Oct 30, 2026 (independent restatement; notes the method used to introduce the update remains unclear, and corrects its own earlier Open VSX framing)Read source
[5] Unite.AI, "Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension", Oct 30, 2026 (secondary restatement of Cursor's notice, the admin-privilege failure condition and remediation steps)Read source

THE ALFW VERDICT

Discount two things in this story: the headline version, in which a backdoor simply worked — Cursor's own analysis says the login step would fail on most macOS and Windows machines — and the early version, in which Anthropic's release channels were compromised — the registries show no trace of the build, and Cursor has claimed its own marketplace as the source. What survives both discounts is still serious: a trusted update path delivered an attacker's SSH key and persistence mechanisms to machines belonging to as many as 5,000 users. The malware's own errors appear to have prevented SSH login on most macOS and Windows hosts, while Cursor's removal of the build and shutdown of the attacker's server disrupted further activity. Neither development removes the need to check affected machines. Check for `svc-telemetry` today if you run Claude Code in Cursor; the check is cheaper than the assumption.