Cursor pulls backdoored Claude Code extension after 11-hour exposure
If you use Cursor and installed the Anthropic.claude-code extension on October 29, you may have a persistent backdoor on your machine, even if you already uninstalled it.
What Happened
Two trojanized versions of Anthropic.claude-code, numbered 2.1.312 and 2.1.313, appeared in Cursor’s marketplace for Windows and macOS. They were available for roughly eleven hours, from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. Cursor estimates up to 5,000 users may have downloaded them.
Anthropic did not create either version. The official npm package, Open VSX listing, and Microsoft VS Code Marketplace version were all clean, according to analysis by OpenSourceMalware. The attack vector was Cursor’s own marketplace, not Anthropic’s infrastructure.
How the Malware Worked
The attacker prepended a 66-line JavaScript loader to the front of the extension file. This meant the malicious code ran before the legitimate extension, and it did not require you to start a Claude conversation. Loading the extension module was enough to trigger it.
Once active, the loader collected system information and credential types present on the machine. It generated a svc-telemetry SSH key and attempted to establish a reverse tunnel to 134.209.82.225. It also sent device data over HTTP on port 8099.
Cursor notes that SSH tunnel attempts typically failed without admin privileges. But the SSH key and persistence scripts could remain on disk regardless, continuing to collect and transmit data.
Why Uninstalling Is Not Enough
“Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.”
On macOS, the persistence mechanism is a LaunchAgent. On Windows, it’s a scheduled task. Cursor’s security guidance tells affected developers to delete the svc-telemetry SSH key, run the provided cleanup scripts, and change any credentials accessible from the affected machine using a separate trusted device.
The Bigger Pattern
This is not an isolated incident. Developer tooling is an increasingly targeted supply chain surface. The Cloud Security Alliance documented the TrapDoor campaign, which used over 34 malicious packages to insert hidden instructions into AI-assistant configuration files. The GlassWorm campaign planted 73 sleeper extensions on Open VSX to target developer credentials and crypto wallets, according to research by Socket. Sonatype identified more than 454,600 new malicious open source packages in 2025 alone.
The Cursor incident fits the same playbook: impersonate a trusted tool, get into the developer’s environment, establish persistence before anyone notices.
The Operator Takeaway
If you installed Anthropic.claude-code versions 2.1.312 or 2.1.313 on October 29, run the cleanup steps Cursor published before doing anything else. Rotate credentials from a clean machine. Do not rely on uninstall alone.
More broadly: treat extension marketplaces the way you treat npm packages. Check version history, publisher identity, and download counts before installing anything that touches your dev environment.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
