A Trojanized Claude Code Extension Sat in Cursor's Marketplace for 11 Hours, Planting an SSH Key Labeled svc-telemetry

For about eleven hours on October 29, 2026, developers who installed or updated the Claude Code extension inside Cursor may have received a backdoor instead. Cursor says a “maliciously modified version” of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, was available in the Cursor VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. Pacific time. The company states the builds “were not developed by Anthropic.”

Microsoft Threat Intelligence published its own analysis of the injected code on October 30. It says it confirmed the malicious packages “were never published nor distributed” through the Microsoft Visual Studio Marketplace or the npm package @anthropic-ai/claude-code, and that Anthropic told Microsoft its systems were not compromised. “At this time, all evidence suggests that the incident is limited to Cursor marketplace,” Microsoft wrote.

Neither company has said how the tampered build got into the marketplace.

A loader that runs before the extension does

According to Microsoft, the attacker added a JavaScript function that runs when the extension module loads, before Claude Code’s own initialization. The extension keeps working normally, and errors and command output are suppressed, which Microsoft says helps avoid alerting the user.

The code first gathers host details: hostname, username, operating system, architecture, home and working directories, and the global Git email. It also scans for environment variable names containing strings such as KEY, TOKEN, SECRET, PASS, AWS or GCP, keeping up to forty matches. Microsoft stresses that the callback sends those names, not their values, so it reveals what kinds of secrets a machine holds without proving the secrets themselves were stolen. Cursor’s notice adds that the public IP address was also collected.

Two keys and a reverse tunnel

The core of the payload is remote access over SSH. The loader checks the user’s authorized_keys file for the comment svc-telemetry and, if it is missing, appends an embedded Ed25519 public key. That gives whoever holds the matching private key a way in, subject to the local SSH server’s settings. It then tries to enable the local SSH service.

A second, separate private key is written to a hidden temporary file named .stk_ plus ten hex characters. SSH uses it to connect out to the attacker’s server and request a reverse forward, -N -R '*:0:localhost:22', so that a port on the remote server leads back to port 22 on the developer’s machine. Host-key checks are switched off. On Unix-like systems the loader prefers autossh; on Windows it uses a hidden PowerShell loop. Both retry about every 60 seconds.

Persistence varies by platform. On macOS the loader writes a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, a name chosen to look like an Apple service. On Linux it adds a user-crontab @reboot entry. On Windows it tries to create a scheduled task named SysMon that runs as SYSTEM, falling back to a sysmon.cmd file in the Startup folder.

Why most victims were probably not reachable

Cursor says that, “due to errors in the malicious code,” the step that turns on the SSH service would fail unless Cursor had been started with administrator rights, which is unusual on macOS and Windows. Without that step the attacker could not have logged in through the tunnel. Cursor also worked with the hosting provider to take the attacker’s server offline, so the tunnel and the host-details beacon no longer work.

That does not make affected machines clean. Cursor notes that the extension still “added the attacker’s SSH key, installed persistence, and sent host details to the attacker.” Microsoft makes the same point: the loader can leave keys and startup entries behind even when the tunnel never connects, and removing or updating the extension does not delete files written outside its folder.

Checking a machine and cleaning it up

Cursor’s check is a single search for the svc-telemetry comment in ~/.ssh/authorized_keys on macOS, or in the user and ProgramData authorized-keys files on Windows. If the key is present, the machine is affected. Cursor has published remediation scripts for both platforms that remove the extension, persistence entries, tunnel processes and the attacker’s key, and exit with an error if anything remains.

Published indicators include the attacker address 134.209.82[.]225, an HTTP beacon on port 8099, the SHA-256 hash of the injected extension.js, and the fingerprint of the planted key. Microsoft also lists Defender detections and hunting queries.

Both companies advise isolating hosts that show signs of the payload, preserving evidence, and rotating credentials and sessions from a trusted device. Cursor says it removed the versions, shut the marketplace down, found no other tampered extensions, rotated its keys and rebuilt the marketplace.

Microsoft’s guidance for prevention is aimed at Cursor’s own settings: restrict extensions to approved publishers and set an installation cooldown, so a newly published version is not installed the moment it appears.