A compromised version of the Claude Code extension put developers at risk through the Cursor editor marketplace. Identified as anthropic.claude-code 2.1.313, the malicious package remained available for approximately 11 hours on October 29 before being discovered and removed. Cursor reported that up to 5,000 users downloaded the affected version. OpenSourceMalware's analysis confirmed the Cursor marketplace as the source of compromise, ruling out the Open VSX registry. The Claude Code extension in Microsoft Marketplace (used by VS Code) and the npm package were both verified as clean.
The malware executed before legitimate code without requiring interaction with Claude. It injected a key called svc-telemetry into the authorized_keys file, attempted to enable SSH, and created a reverse tunnel for remote access. The attack also installed persistence mechanisms and exfiltrated machine information. While coding errors and insufficient privileges could prevent SSH activation in some cases, they did not eliminate other infection vectors. The persistent threat meant that simply updating or uninstalling the extension wasn't sufficient—independent scripts could continue running on affected systems.
Cursor removed the package immediately, audited its marketplace, rotated security keys, and took down the attacker's server with their hosting provider. For users who installed version 2.1.313, Cursor recommended checking published indicators of compromise, manually removing the injected key and persistence mechanisms, isolating machines showing signs of execution, and resetting credentials from a trusted device.