Calum Hall at Phorion found an SSH backdoor in version 2.1.313 of the Claude Code extension and reported it as an Open VSX compromise.
Cursor’s notice, dated 29 October, traces it to Cursor’s marketplace instead, says Anthropic did not build that version and counts at most 5,000 users.
OpenSourceMalware shows a 66-line loader prepended to extension.js that runs when the extension starts, no Claude prompt needed.
It appends an Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to switch on SSH, opens a reverse tunnel to 134.209.82.225 and persists through a LaunchAgent, an @reboot cron entry or a SysMon scheduled task.
It also beacons hostname, user, Git email and the names of environment variables that smell like secrets.
Uninstalling the extension won’t remove the backdoor.
If 2.1.313 ever loaded, look for the svc-telemetry key, isolate the host, run Cursor’s remediation scripts and rotate every credential the account could reach, from a clean machine.
Cursor asks all users to update to 2.1.314.
OpenSourceMalware recommends rebuilding the host, sensible for a laptop that may have offered port 22 to a stranger.
Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace.