If you installed or updated the Claude Code extension in Cursor on 29 October 2026, check your machine today. Cursor says a modified build, Anthropic.claude-code version 2.1.313, sat in its extension marketplace from about 2:27am to 1:35pm Pacific time. Cursor says the build was not developed by Anthropic and that at most 5,000 users were affected.
The build tries to plant a persistent SSH backdoor, and Cursor warns that uninstalling the extension may not remove it. This playbook gives the checks and the cleanup in the order to run them, then the controls that stop the next malicious extension.
What Did the 2.1.313 Build Do?
OpenSourceMalware found a 66-line loader placed before the normal code in the extension’s main file. It runs when the editor loads the extension, so the user never has to open a Claude chat. The rest of the package matched the normal release.
The loader first collects the hostname, username, operating system, home directory and global Git email. It also takes the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP. OpenSourceMalware says the values are not in the first beacon, but the names show which clouds and credentials a machine holds.
Next it adds an attacker Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys. It tries to switch on the local SSH service and opens a reverse SSH tunnel to the attacker’s server, retrying every 60 seconds. Persistence is a LaunchAgent named com.apple.sysmond on macOS, an @reboot crontab entry on Linux, and a SysMon scheduled task on Windows.
Cursor adds two limits. Turning on SSH needs admin rights, which the extension lacks on most macOS and Windows hosts, so there the attacker could not log in through the tunnel. Cursor also says it worked with the hosting provider to take the attacker’s server offline. The key, the persistence scripts and the host report still land, so clean up anyway.
Which Marketplace Served the Bad Build?
Early reports said the build came from Open VSX, an open extension registry that VSCodium uses by default. OpenSourceMalware has since posted an update: Cursor told it the compromise was in the Cursor Marketplace, “not Open-VSX”. Its post now lists the npm package, the Open VSX extension and the Microsoft Marketplace extension as not malicious.
Our own registry check on 30 October at 09:03 UTC matched that. Open VSX and the Visual Studio Marketplace list versions 2.1.312 and 2.1.314 of anthropic.claude-code, and neither lists 2.1.313. The confusion lasted: 9 of the 67 X posts we collected between 07:34 and 08:58 UTC that day still named Open VSX as the source.
The lesson is that one extension ID can live in several registries. A trusted publisher name in one store says nothing about the copy another store serves.
The Playbook: Find, Contain, Clean, Rotate
Run these steps on every machine where a developer uses Claude Code inside Cursor or another VS Code-based editor. Cursor’s own advice, posted on X, is to update to version 2.1.314.
- Find the buildList installed extensions with versions and search the disk for a folder named anthropic.claude-code-2.1.313. Cursor’s indicators name darwin-arm64 and win32-x64 builds.
- Check for the attacker keySearch authorized_keys for svc-telemetry. On Windows also check the ProgramData administrators file. A match means the machine is affected.
- Look for persistence and the tunnelCheck for the com.apple.sysmond LaunchAgent, .smt files under ~/.config, an @reboot crontab line or the SysMon task. Look for ssh or autossh processes with -R and localhost:22.
- Isolate and preserve firstTake an affected host off the network and keep evidence before you remove anything. Block the attacker address on ports 22 and 8099 at the edge.
- Remove, then decide on a rebuildUse Cursor’s remediation scripts or remove the key, scripts, task and extension by hand. OpenSourceMalware says a rebuild is safer than trusting the cleanup.
- Rotate secrets from a clean machineRotate every credential the affected account could reach, starting with those whose names appear in its environment variables.
These commands cover the first three steps. The svc-telemetry check comes from Cursor’s notice; the others search for the file and task names in the analysis.
# Steps 1 to 3 on macOS or Linux
code --list-extensions --show-versions | grep anthropic.claude-code
cursor --list-extensions --show-versions | grep anthropic.claude-code
find ~ -maxdepth 4 -type d -name 'anthropic.claude-code-2.1.313*' 2>/dev/null
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found"
ls ~/Library/LaunchAgents | grep sysmond
ls -a ~/.config | grep smt
crontab -l | grep @reboot
pgrep -fl 'ssh.*-R'
# Windows (PowerShell)
schtasks /query /tn SysMon
Select-String svc-telemetry "$HOME\.ssh\authorized_keys"
Select-String svc-telemetry "C:\ProgramData\ssh\administrators_authorized_keys"Cursor lists the attacker address as 134.209.82[.]225. The attacker key’s fingerprint is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. Search endpoint and network logs for both from 29 October onward.
Why Run the Steps in This Order?
The tunnel and the key outlive the extension. Cursor warns that uninstalling may not be enough, because the payload drops standalone scripts that keep running. So you confirm the backdoor before you touch the extension, or you lose the easiest signal.
Isolation comes before cleanup because an open tunnel gives the operator a live path to the host. OpenSourceMalware notes that any files moved after access would not appear in the static sample. Rotation comes last and runs from another machine, so new secrets never touch a host the attacker may still reach. Our secrets rotation checklist from the Railway breach gives an order for cloud and CI keys.
How Do You Stop the Next Malicious Extension?
This is not the first time an editor extension became the entry point. The GlassWorm malware spread through VS Code and Open VSX extensions. The Nx Console extension breach ended with GitHub-internal repositories stolen, and our questions on dev tools as an entry path still apply. Both fit the MITRE technique for compromising a software supply chain.
Three controls reduce the risk without banning extensions. The same ideas apply to browser extensions, which one vendor report says a campaign it calls ShadyPanda abused.
- Allow-list by publisher, ID and version. VS Code 1.96 and later has an extensions.allowed setting, and admins can enforce it as the AllowedExtensions policy. It can pin an extension to listed versions and platforms.
- Know which registry each editor uses. VSCodium installs from Open VSX by default, and Cursor serves extensions from its own marketplace. Check each editor’s own controls; VS Code settings may not apply to a fork.
- Treat developer laptops as privileged endpoints. Keep long-lived cloud keys out of shell profiles, and alert on new authorized_keys entries and new LaunchAgents or scheduled tasks.
Engineer laptops with production access were the weak point in our DevOps security lessons from October 2026 too. An extension that runs on load is one more automated system with standing access to those machines. The scheduled task trick here is scheduled task persistence, so existing detections for that technique apply.
A useful first move this week: export the extension list from every developer machine, with versions and the registry each came from. Anything you cannot explain goes on the allow-list review.