A maliciously modified version of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, was available in Cursor’s VS Code extension marketplace for about 11 hours on October 29. Cursor said the affected packages were for Windows and macOS, were not developed by Anthropic, and potentially affected up to 5,000 users, according to Reuters. The incident adds to growing concerns around AI coding agents and the extensions they depend on.
In its security notice, Cursor said the packages collected host and user information including hostnames, usernames, operating systems, architecture details, home-directory paths, environment-variable names, working directories, configured Git email addresses and public IP addresses. The code also attempted to add an attacker-controlled SSH key labelled svc-telemetry, enable the local SSH service and open a reverse SSH tunnel. It installed persistence mechanisms through a LaunchAgent on macOS or a scheduled task with a startup-script fallback on Windows.
Cursor said enabling the local SSH service required administrator privileges and that errors in the malicious code meant this step would fail on most affected computers unless the editor was running with elevated permissions. However, the extension still added the attacker’s key, installed persistence files and sent host details to the operator. Cursor said the attacker’s server has been taken offline and that it found no evidence that other extension versions or the official distribution were affected.
Researchers at StepSecurity analyzed the malicious package and found a loader placed ahead of the legitimate extension code. The loader ran when the extension module loaded, so the malicious behavior did not depend on a user starting a Claude conversation. Cursor said it removed the affected versions, temporarily shut down its marketplace, audited other extensions, rotated its keys and rebuilt the service.
Anyone who installed version 2.1.312 or 2.1.313 from Cursor’s marketplace during the exposure window should follow Cursor’s cleanup instructions, check for the svc-telemetry SSH key, remove persistence mechanisms and running tunnel processes, and rotate credentials accessible from the affected machine using a trusted device. Uninstalling the extension alone may not remove the files it left behind.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
