Fake "official Anthropic" Claude Code extension sat on Cursor's marketplace for 11 hours; up to 5,000 users hit by SSH backdoor attempt

A malicious build posing as Anthropic's Claude Code extension was available on Cursor's extension marketplace for about 11 hours.

In a security notice on Oct. 29, Cursor said Anthropic.claude-code version 2.1.313 was live from 2:27 a.m. to 1:35 p.m. PT and "was not developed by Anthropic." It put the number of affected users at no more than 5,000 and said it would contact them directly.

According to the notice, the extension collected the hostname, username, OS, public IP and Git email, added an attacker's SSH key labeled "svc-telemetry" to authorized_keys, and tried to open a reverse SSH tunnel, retrying every 60 seconds through a macOS LaunchAgent. Without admin rights the step that turns on the SSH service fails, so the tunnel could not be used to log in, but the key, the persistence scripts and the data upload still happen. Cursor said the attacker's server has been taken offline.

Mac users can check with `grep -qs svc-telemetry ~/.ssh/authorized_keys`. If the key shows up, uninstalling the extension is not enough: persistence scripts and tunnel processes must be removed separately and credentials on that machine rotated. Cursor asked all customers to update to Claude Code for VS Code 2.1.314 or later. It briefly shut the whole marketplace as a precaution, rotated its keys and reopened it.

Cursor's post passed 3,000 likes. One reply (61 likes) asked how a modified build got published under the official Anthropic name, a detail missing from the post. A Reddit r/ClaudeCode thread claimed "the official Claude Code VS Code extension was compromised," but Cursor said it has no evidence that other versions or the official distribution were affected.