Trojanised Claude Code Extension Sat on Cursor's Marketplace for 11 Hours With an SSH Backdoor

Two tampered versions of the Claude Code extension, 2.1.312 and 2.1.313, were served from Cursor's extension marketplace on 29 October and installed a backdoor that let an attacker log in to developers' machines over SSH. Cursor says the versions were live "Between about 2:27am PT and 1:35pm PT", and it puts the reach at "at most 5,000 users", according to The Hacker News.

Only Cursor's marketplace served the versions. Microsoft, which analysed the malware, says the packages "were never published nor distributed from Microsoft Visual Studio Marketplace", and Anthropic says its official channels, including VS Code and Open VSX, weren't affected. The tampered versions carried the official extension ID, so there was no lookalike name to spot.

What the extension did

Microsoft's write-up describes a loader that "appends an embedded public key and attempts to enable the local SSH service", then opens a reverse SSH tunnel back to the attacker and retries every 60 seconds. The malware also sent the host name, user, operating system, Git email and the names of environment variables, not their values. To survive reboots it installed a LaunchAgent on macOS, a crontab entry on Linux and a scheduled task or Startup-folder script on Windows.

Errors and the need for administrator rights blocked SSH access on most macOS and Windows hosts, Microsoft found.

Cursor pulled the versions, rebuilt its marketplace and rotated its keys, according to its security notice. Microsoft doesn't attribute the attack to any group.

How to check a machine

• Microsoft's first check is to look in ~/.ssh/authorized_keys for a key with the comment svc-telemetry, and check whether Cursor installed extension version 2.1.312 or 2.1.313.
• Other indicators to search for, per Microsoft: the server 134.209.82[.]225 (beacon on port 8099), ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, sysmon.cmd in the Windows Startup folder, the files ~/.config/.smt and ~/.config/.smtk, and tunnel keys named .stk_*.
• Defender detects the components as Trojan:MacOS/SmtShellMal.A and HackTool:MacOS/RevAnthShell.A, among others.

If a machine was affected

Cursor warns that uninstalling the extension alone may not be enough and publishes a remediation script. Microsoft advises isolating the machine and keeping the evidence, then removing the SSH key, the persistence entries, the hidden files and any tunnel processes. Microsoft also advises rotating credentials and sessions from a different, trusted machine, and rebuilding the infected one if trust can't be restored. For teams, Microsoft suggests allowing extensions only from approved publishers.