On October 29, Cursor published a security advisory saying a tampered build of Anthropic.claude-code 2.1.313 had appeared in its VS Code extension marketplace. The build was not made by Anthropic, and up to about 5,000 users downloaded it. Cursor has pulled the version, briefly shut down the entire marketplace, rotated its own keys and rebuilt it before bringing it back online, and says it will contact affected users one by one.
By the timeline in the advisory, the malicious version was available for download from around 2:27 a.m. Pacific Time that day and was only taken down at 1:35 p.m., a window of about 11 hours. Cursor says it has found no sign that the official version or any other extension in the marketplace was altered.
What it did once installed
The extension first collected a round of host information: hostname, username, operating system and architecture, home directory path, the names of environment variables, the current working directory, the Git email address and the public IP. It then sent all of it by HTTP POST to the /beacon endpoint on port 8099 of an attacker-controlled server.
Next it tried to leave a long-term backdoor. It wrote the attacker's SSH public key into authorized_keys, turned on the machine's SSH service and set up a reverse SSH tunnel back to the attacker. On macOS it persisted through a LaunchAgent; on Windows it tried to register a scheduled task running as SYSTEM and fell back to a startup script if that failed. A background script retried the tunnel roughly every 60 seconds.
The attacker's code was itself flawed. Unless Cursor had been launched with administrator privileges, the tunnel step would mostly fail. The attacker's server has also been taken offline by its hosting provider, so neither the tunnel nor the reporting channel can connect now. Cursor cautions that a failed tunnel does not mean you are in the clear: the public key, the persistence scripts and the host information already sent out may all have landed.
“Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.”
What users should check
The advisory's checking steps are fairly direct. Look in the SSH authorized-keys list for a public key named svc-telemetry. Search terminal, network and extension-install logs for the IPs, ports and two VSIX file hashes it lists (one package for macOS arm64, one for Windows x64). A machine that shows signs of execution should be isolated first, then cleaned with the official script to remove the key, the persistence items and the tunnel process, and reinstalled if necessary.
The last step is the easiest to skip: every credential and session that machine could reach needs to be rotated, and from a clean computer. Cursor says the extension read only the names of environment variables, not their values, but once a backdoor is open the attacker could easily come back for more.
Coding tools have become supply-chain targets
Set against the past year, supply-chain incidents around AI coding tools have not let up. We have reported on the poisoning of LiteLLM 1.107.0, which was built to steal AI service keys, and on a VS Code extension flaw that led to the theft of 3,800 GitHub repositories. This time the attacker picked the name Claude Code: a large install base, and users who are used to granting it terminal and file permissions, so the payoff from impersonating it is high.
Editors built on VS Code, such as Cursor and Windsurf, cannot use Microsoft's official extension marketplace directly. They have to plug into Open VSX or build their own distribution channel, and review and signing practices differ from vendor to vendor. Anthropic has not publicly responded to the incident, and Cursor has not explained how the impostor build was listed under the official publisher identity. Until that link is closed, other popular extensions could be impersonated in the same way.
For developers in China, plenty of people use Cursor, and many have this kind of editor installed on machines inside company networks. If you updated the Claude Code extension around October 29, running through the steps above costs very little.
Sources: Cursor security advisory (used to verify the affected version number, the download window and the 5,000-user ceiling), CocoLoop, the indicator-of-compromise list attached to Cursor's advisory (used to verify the port, the retry interval and the two VSIX hashes).