Trojanized Claude Code Extension Hit Up to 5,000 Cursor Users

A trojanized build of Anthropic's official Claude Code VS Code extension sat in Cursor's marketplace for most of October 29, exposing up to 5,000 developers to a reverse-SSH backdoor delivered as a routine auto-update. The Hacker News reported that version 2.1.313 of anthropic.claude-code, served only through Cursor's own extension marketplace between 2:27 a.m. and 1:35 p.m. PT, carried a 66-line loader stitched in front of the legitimate code.

The payload wrote an attacker-controlled public key labeled 'svc-telemetry' to ~/.ssh/authorized_keys, opened a reverse tunnel to 134.209.82.225, and beaconed host details to the same IP on port 8099 over unencrypted HTTP. It persisted differently per OS: scheduled tasks on Windows, crontab entries on Linux, and a LaunchAgent on macOS. The loader also scraped environment-variable names matching KEY, TOKEN, SECRET, PASS, AWS, or GCP back to the operator.

"The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," said Jenn Gile of OpenSourceMalware. The blast radius had a soft ceiling: enabling the local SSH service needs admin rights, which the extension lacked on most macOS and Windows hosts. "On those hosts the step fails and the attacker could not have logged in through the tunnel," Cursor said, while noting the SSH key, persistence, and host-detail exfil still landed.

Cursor pegged the exposure at "at most 5,000 users" and said "this malicious version of the extension was not developed by Anthropic." Anthropic published a clean 2.1.314 to Open VSX and the Microsoft VS Code Marketplace on October 30.

"It was pulled very quickly," Gile said, "but anyone who has their Claude Code instance set to auto-update could have consumed the malware."