# Trojanized Claude Code Extension on Cursor's Marketplace Plants an SSH Backdoor. Check for the svc-telemetry Key Now

Cursor says malicious builds of the Claude Code extension (2.1.312 and 2.1.313, macOS and Windows) were live on its marketplace from about 2:27am to 1:35pm PT on 29 October. They add an attacker SSH key, a reverse tunnel and persistence that uninstalling may not remove. Cursor says Anthropic did not build them, and nobody has said how they were published under Anthropic's extension ID.

By Neomanex. Updated 2026-10-31.

Act today if you run the Claude Code extension inside Cursor. Cursor says malicious builds of Anthropic's Claude Code extension sat on its marketplace for about 11 hours on 29 October, and the backdoor they plant survives an uninstall. Our verdicts on Cursor and Claude Code both stay conditional, because nothing here points at Claude Code itself, but the check takes ten seconds and should not wait.

## What happened

Cursor's security notice, published 29 October and updated at 11:30am PT on 30 October to "clarify affected versions", now names "Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS" in the Cursor VS Code extension Marketplace. The window ran from about 2:27am to 1:35pm PT on 29 October. Cursor states: "These malicious versions of the extension were not developed by Anthropic."

Sources differ on the version list. OpenSourceMalware and The Hacker News name 2.1.313 only; Cursor's updated notice and Phorion's advisory name both 2.1.312 and 2.1.313. We follow Cursor, the operator of the marketplace. The Hacker News puts exposure at up to 5,000 users; the version of Cursor's notice we read on 31 October gives no user count.

The Hacker News reports the malicious build was shipped under Anthropic's legitimate anthropic.claude-code extension ID, with "a malicious 66-line loader inserted before the legitimate extension code", rather than as a separate fake extension. Nobody has said how the attacker got the right to publish under that ID. Cursor says only: "We rotated our keys, rebuilt the marketplace, and brought it back online," and "We audited access and confirmed no other extensions were tampered with."

Anthropic has made no statement in anything we read. Its Claude Code changelog goes from 2.1.312 (27 October) to 2.1.314 (30 October), with no 2.1.313 entry and no mention of the incident.

### What the payload does

Per Cursor, the extension collects host details, installs an attacker SSH key labelled svc-telemetry, sets up reverse SSH tunnelling with persistent backdoor access, and retries the connection "roughly every 60 seconds" through a LaunchAgent on macOS or a scheduled task named SysMon on Windows. Cursor warns that uninstalling the extension "may not be sufficient", because the payload drops standalone persistence scripts.

OpenSourceMalware lists what the first beacon sends: hostname and local username, OS details, directory paths, and the "Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP". It notes that "Environment-variable values are not placed directly in the initial beacon", but the names alone tell the attacker which credentials live on the machine.

On Linux, Cursor's indicators list a cron @reboot entry that runs ~/.config/.smt, and OpenSourceMalware describes the same crontab persistence. Phorion adds that a bug in the crontab check "can wipe existing user cron jobs on repeat runs".

### Which marketplaces were hit

Cursor's notice covers its own marketplace only. OpenSourceMalware, which says Cursor contacted it, writes: "The @anthropic-ai/claude-code NPM package is NOT malicious. The OpenVSX extension is NOT malicious. The Microsoft VSCode extension for Claude is NOT malicious." The Hacker News says users who installed from Open VSX or Microsoft's VS Code Marketplace were unaffected, and that version 2.1.314 went out to both. Treat Cursor's marketplace as the only affected channel until Anthropic or Cursor publishes how the builds were shipped.

## Why it matters

The backdoor is real even where the tunnel fails. Cursor says "turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts", and that outside of "highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail." Phorion's macOS analysis says that if Remote Login was not already on, traffic forwarded back through the tunnel "will hit a closed port 22". Read the other way: a Mac that already had Remote Login enabled was reachable. The key, the persistence and the beacon land regardless. Cursor says "the attacker server no longer functions", and still tells affected users to remediate.

The bigger problem is the publishing control. Cursor caught this the same day, pulled the builds, published indicators and cleanup scripts. That is a fast response, but it answers what happened, not how. A marketplace that let someone ship under a major vendor's extension ID has a publishing control problem, and we will weigh it against Cursor's conditional rating when the root cause is published. Claude Code stays conditional too: nothing in the record points to Anthropic's own build or release channels, so do not read this as "Anthropic was hacked".

## What changes for you

Run the check on every machine that had Claude Code installed in Cursor on 29 October.

macOS, from Cursor's notice:

```
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found"
```

Windows PowerShell, from Cursor's notice:

```
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" }
```

Indicators Cursor publishes:

- Network: attacker IP 134.209.82.225, SSH port 22, beacon port 8099
- Key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk (Phorion also lists a tunnel key, SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ)
- Linux and macOS: an unauthorized key in ~/.ssh/authorized_keys, plus ~/.config/.smt and ~/.config/.smtk
- Linux: /tmp/.stk_ followed by 10 hex characters, and cron @reboot /bin/sh "<HOME>/.config/.smt"
- macOS: $TMPDIR/.stk_ followed by 10 hex characters, and ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond)
- Windows: %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_ followed by 10 hex characters, the scheduled task SysMon, and a fallback sysmon.cmd in the Startup folder

On a hit, do not rely on uninstalling. Run Cursor's remediate-macos.sh as the affected user (not as root) or remediate-windows.ps1 from PowerShell opened with Run as Administrator, then rotate every credential the machine could reach from a clean device.

We did not run the extension or the remediation scripts. Everything above comes from Cursor's notice, the Phorion and OpenSourceMalware analyses, The Hacker News and Anthropic's changelog.

Canonical: https://neomanex.com/news/claude-code-extension-cursor-marketplace-trojanized-2-1-313-ssh-backdoor