Cursor's Claude Code Extension Was Backdoored for 11 Hours. It Installs an SSH Key and Reverse Tunnel Before the Extension Even Activates.
A tampered build of the Claude Code extension sat live in Cursor's own extension marketplace for about 11 hours on October 29. Installing or already running it planted an SSH key, opened a reverse tunnel to an attacker's server, and started trying to persist itself, all before the extension's normal startup code ever ran. This is the third developer-tooling compromise we've written about in 24 hours, after Binance's engineer-laptop account and fake recruiter coding tests. The pattern is the same: the machine that holds a developer's access is now the target, and the editor itself is one of the doors.
What happened
macOS security firm Phorion found a tampered version of the extension, anthropic.claude-code 2.1.313, and published a technical breakdown. Cursor confirmed it in a security notice the same day. OX Security published a second independent writeup with additional indicators. The malicious build is explicitly not Anthropic's own distribution; Cursor's notice describes the compromise as being in its own extension marketplace, not Anthropic's official channel. We have not independently verified the exact distribution path and treat that detail as Cursor's account, not ours.
Cursor says the exposure window was roughly 2:27 AM to 1:35 PM Pacific on October 29, about 11 hours, and that at most 5,000 users were potentially affected. It says it pulled the version, took its marketplace down temporarily, audited for other tampered extensions (found none), rotated its own keys, worked with the attacker's hosting provider to take the command-and-control server offline, and rebuilt the marketplace before reinstating it.
How it worked
Phorion's technical detail is specific: the compromised extension.js has an immediately invoked function expression prepended to the minified bundle, importing child_process, fs, os, path, http and crypto. It runs as soon as Node loads the file, before the extension's own activate callback, so no click or configuration is needed beyond having the bad version installed.
- Writes an SSH key, commented svc-telemetry, into the user's authorized_keys.
- Opens a reverse SSH tunnel to the attacker's server, which survives closing the editor and retries roughly every 60 seconds.
- Collects hostname, username, OS, home and working directories, Git email, and public IP, plus the names (not values, per the published accounts) of up to 40 environment variables shaped like keys, tokens, passwords, or AWS/GCP credentials.
- Tries to persist itself per platform: a macOS LaunchAgent, a Windows scheduled task (falling back to the Startup folder), and related dotfiles under .config on both.
macOS and Windows both needed Remote Login or an SSH server enabled to let the attacker actually use the key, and Cursor says that step largely failed because the extension doesn't run with admin rights on a typical install. The key and the persistence mechanism were still planted either way. Phorion's warning stands: if SSH is already on, or someone turns it on later, the planted key still works.
Indicators, two sources
Phorion's and Cursor's accounts cover the mechanism. OX Security published hashes and exact paths that let defenders actually search for this.
- anthropic.claude-code version 2.1.313, modified builds identified for darwin-arm64 and win32-x64. No Linux build has been published; do not assume a Linux variant from these sources.
- extension.js SHA-256 (darwin-arm64): [432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62](https://analytics.dugganusa.com/stix/register?ref=hash-click&q=432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62)
- extension.js SHA-256 (win32-x64): [3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081](https://analytics.dugganusa.com/stix/register?ref=hash-click&q=3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081)
- C2 / reverse-tunnel endpoint: [134.209.82.225](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=134.209.82.225), TCP 22 (SSH) and TCP 8099 (/beacon, HTTP POST). This address is already a ThreatFox botnet_cc entry in our own feed as of this morning; we are citing it, not claiming it as our find.
- Local beacon attempt: [127.0.0.1](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=127.0.0.1):8099/beacon
- Unauthorized authorized_keys line, commented svc-telemetry
- Key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
- Reverse-tunnel key fingerprint: SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ
- macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond), plus ~/.config/.smt, ~/.config/.smtk
- Windows: scheduled task SysMon, fallback %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd, plus %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk
Check your own machine
macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
Windows (PowerShell): check both $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry.
Both OX Security and Cursor say uninstalling the extension is not enough on its own, because the payload drops standalone scripts that keep running. If you find the key or any of the persistence paths above, isolate the machine, remove the key and the persistence files, kill any running ssh -N -R or autossh processes matching the pattern, and rotate every credential reachable from that machine from a trusted device. The environment-variable names the malware collected are a map of which secrets to rotate first.
What we did and didn't do
We checked our own repository and found no reference to this package, IP, or key, and no coincidental match on the hashes. That tells us our tracked source doesn't contain these indicators; it is not an endpoint sweep and we are not claiming our development machines are confirmed clean, because that check has to run on the machine itself, with the commands above.
The C2 address was already in our feed via ThreatFox before this post went up. We are not adding it again under our own name. The file hashes and SSH key fingerprints are new to our corpus; we will add the hashes to the feed credited to Phorion, Cursor and OX Security.
Limits
Everything here comes from Phorion's writeup, Cursor's own security notice, and OX Security's follow-up, read today. We did not reproduce the backdoor and have not independently confirmed the exposure window, the 5,000-user figure, or the exact distribution channel; those are the vendors' own numbers. The sources disagree slightly on where the tampered build was distributed, and we have not resolved that. No Linux indicators have been published; absence of a Linux build in these reports is not confirmation that Linux installs were untouched.
Five percent of this is wrong somewhere. It always is.
If this was useful, or was not, rate it at the bottom of the page.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.