Malicious Claude Code Extension Found in Cursor Extension Marketplace, Up to 5000 Users Affected

According to TechFlow, on October 30, Cursor's official blog reported that the Cursor VS Code Extension Marketplace listed a maliciously tampered version of Anthropic.claude-code 2.1.313 between 2:27 and 13:35 Pacific Time on October 29. This version was not developed by Anthropic, and up to 5000 users were affected. Cursor will contact these users directly. The extension collects information such as hostname, username, and public IP address, attempts to write the attacker's SSH public key (labeled svc-telemetry), enables the local SSH service, establishes a reverse tunnel, and plants persistence scripts on macOS and Windows.

Because enabling the SSH service requires administrator privileges, this step will fail on most hosts, preventing attackers from logging in through the tunnel. However, key writing, persistence, and host information exfiltration still occur. The attacker server 134.209.82.225 has been taken offline. Cursor has removed the version, temporarily shut down the extension marketplace, rotated keys, rebuilt the marketplace, and relaunched it. There is currently no evidence that other versions are affected. Cursor recommends that affected users check whether the svc-telemetry key exists in authorized_keys, run the official remediation script, and rotate related credentials.

Source: TechFlow