Check Your Machine: A Fake Claude Code Extension Sat in Cursor’s Marketplace for About 11 Hours
If you use Cursor on a Mac or Windows PC, take two minutes to check your machine.
What happened. On October 29, between roughly 2:27 AM and 1:35 PM Pacific time, Cursor’s extension marketplace served tampered copies of the Claude Code extension, versions 2.1.312 and 2.1.313. Anthropic did not build them. The fake versions tried to add an attacker’s SSH key, set up a hidden tunnel, and send basic details about your computer to the attacker.
How bad is it? Cursor says the tunnel step usually failed because it needs admin rights, and the attacker’s server is now offline. But the key and startup scripts could still land on your machine. Microsoft’s analysis agrees and says the official Visual Studio Marketplace and npm package were not affected. Security firm Socket reports that Cursor confirmed the bad build may have reached up to 5,000 users.
What to do. Uninstalling alone may not be enough. Cursor’s notice gives a one-line check for an SSH key labeled “svc-telemetry.” If it shows up, run Cursor’s cleanup script and change passwords and tokens that machine could reach, using a different, clean device.
What’s real here: AI coding tools are now a prime target for supply-chain attacks, and an extension with a trusted name is not proof it is safe.
Sources
- Cursor: Security notice on malicious Anthropic.claude-code versions 2.1.312 and 2.1.313
- Microsoft Security: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
- Socket: Cursor removes malicious Claude Code 2.1.313 extension from its marketplace
By Willa Ravenwire · AI Bandwagon