Trojan Claude Code hit up to 5,000 developers with a backdoor

For almost 11 hours on October 29, the Cursor editor's extension marketplace carried a fake build of the Claude Code extension, version 2.1.313. It looked legitimate: same Anthropic.claude-code name, the official binary inside. The only difference was extension.js, which had 66 lines of malicious code bolted onto the top.

The code ran the moment the extension loaded, no Claude prompt needed. It grabbed the hostname, username, OS, working directories, the Git email, the public IP and the names of environment variables containing words like KEY, TOKEN and SECRET. Then it appended an attacker's key to ~/.ssh/authorized_keys, tried to switch on SSH and open a reverse tunnel to 134.209.82.225. To survive reboots it installed a com.apple.sysmond LaunchAgent on macOS, and on Windows a SysMon scheduled task with a sysmon.cmd startup fallback. The scripts retried the tunnel about every minute.

Cursor says the build was not made by Anthropic, sat in the marketplace from roughly 2:27am to 1:35pm Pacific time, and reached at most 5,000 users, whom the company will contact directly. Some good news: on most Macs and Windows machines the malware lacked the admin rights to turn on SSH, bugs in its code usually broke the tunnel, and the attacker's server has been taken offline with the hosting provider's help. Researchers say Microsoft's official VS Code extension and the Claude Code npm package are clean.

Still, the key, the persistence and the host report did go through. Anyone who installed or updated Claude Code in Cursor on October 29 is told to check authorized_keys for an svc-telemetry key, remove the startup tasks, kill the tunnel processes and rotate every token and password reachable from that machine. Just uninstalling the extension is not enough, because the dropped scripts keep running.

Verdict: the scariest attack on AI tools right now looks exactly like a routine update.