For about 11 hours on October 29 (2:27 a.m. to 1:35 p.m. PT), Cursor’s extension marketplace served a tampered Anthropic.claude-code version 2.1.313. Cursor says at most 5,000 users got it.
What it did
- Collected host and user details, including Git email and public IP.
- Added an attacker SSH key labeled
svc-telemetrytoauthorized_keys. - Tried to enable SSH and open a reverse tunnel, with persistence through a macOS LaunchAgent or a Windows scheduled task.
Bugs in the malware meant turning on SSH usually failed without admin rights. But the key, the persistence and the beacon still landed, and uninstalling the extension doesn’t remove them.
Who’s to blame?
Anthropic says it wasn’t a breach of its systems and the official channels are fine. Cursor (now part of SpaceXSI) pulled the package, rebuilt the marketplace and rotated keys. Nobody has explained yet how the attacker published under Anthropic’s name.
My take
If you use Cursor, check for that key today. I wrote a how-to for that in this batch. Then rotate anything that machine could reach.
God Bless, and Needs Garlic!
