A malicious version of Claude Code, identified as 2.1.313, was available in Cursor’s VS Code extension marketplace on October 29. The package attempted to add an attacker-controlled SSH key, maintain a remote tunnel, and send information about the computer. Cursor estimates that up to 5,000 users may have been affected and says it will contact them directly.
The extension used the legitimate identifier anthropic.claude-code, but Cursor clarified that this version was not developed by Anthropic. The incident was limited to Cursor’s marketplace: OpenSourceMalware said the Claude Code npm package and the extensions distributed through Open VSX and Microsoft were not malicious. The Hacker News reported that Anthropic published version 2.1.314 on Open VSX and in the official VS Code marketplace.
A malicious payload alongside legitimate code
The altered version was available from approximately 2:27 to 13:35 Pacific Time on October 29. Cursor said it detected the incident, removed the package, and blocked its distribution. As a precaution, it temporarily shut down its VS Code marketplace, reviewed access, and confirmed that no other extensions had been tampered with. It then rotated its keys, rebuilt the marketplace, and brought it back online.
OpenSourceMalware’s analysis described a 66-line malicious loader added before the extension’s normal code. According to the analysis, simply loading the module in VS Code was enough; starting a conversation with Claude was not necessary. The extension could continue working as usual while running the added payload’s actions in the background.
The program collected data such as the computer and user names, operating system, architecture, home directory, working directory, and the global email configured in Git. It also collected the names of environment variables that could contain terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP; according to OpenSourceMalware, their values were not included in the initial transmission.
It then attempted to add an SSH key labeled svc-telemetry to the user’s authorized keys, enable the local SSH service, and open a reverse tunnel to a machine controlled by the attacker. It also installed persistence mechanisms: a LaunchAgent on macOS and, on Windows, a scheduled task or an alternative startup script. In its analysis, OpenSourceMalware noted that the code also included a branch using cron for Linux.
“It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware”
— Jenn Gile, co-founder of OpenSourceMalware
Server taken offline; Cursor urges users to check their computers
The tunnel and data transmission pointed to the address 134.209.82.225. Cursor said it worked with the hosting provider to take the server offline, so those communications no longer work. The company also warned that enabling SSH requires administrator privileges and would have failed on most macOS and Windows computers without those privileges. That would not have prevented the extension from adding the key, installing persistence, or sending the collected data.
Cursor recommends that anyone who installed or updated to version 2.1.313 from its marketplace during the specified period check whether the svc-telemetry key appears in their authorized SSH keys. If they find it, the company advises isolating the computer, removing the key and persistence mechanisms, and considering whether the system needs to be rebuilt. Uninstalling the extension may not be enough, because the persistence scripts are separate from the package.
The company also advises rotating, from a trusted computer, any credentials and sessions that the affected device may have been able to access. OpenSourceMalware found no downloads of additional payloads in the code it analyzed; even so, the tunnel would have provided a means of SSH access if the local service had been enabled. Cursor has not publicly attributed the attack in its notice, and The Hacker News noted that the method used to introduce the update was unclear.
Sources: Cursor, OpenSourceMalware, The Hacker News
