Cursor removes malicious Claude Code extension affecting up to 5,000 users

• Up to 5,000 Cursor users were affected by a malicious Claude Code extension, according to Cursor's disclosure.
• Anthropic neither built nor published the tampered copy, as a public clarification states.
• Updating or uninstalling the extension does not remove all host artifacts: the recovery notice linked in Cursor's announcement describes SSH keys and standalone persistence scripts.

The ugliest detail: the legitimate extension kept functioning while injected JavaScript executed ahead of its normal initialization. The reverse SSH connection originated from the workstation, with background scripts retrying roughly every 60 seconds.

Cursor's notice, updated October 30 at 11:30 a.m. PT, identifies two affected Anthropic.claude-code versions: 2.1.312 and 2.1.313. The malicious packages were available through Cursor's VS Code Extension Marketplace on October 29, from approximately 2:27 a.m. to 1:35 p.m. PT, an exposure window of 11 hours and eight minutes.

The published package hashes cover two platform builds:

• macOS: darwin-arm64.
• Windows: win32-x64.

Microsoft confirmed that the malicious packages never appeared in the Microsoft Visual Studio Marketplace or the official Claude Code npm distribution. Anthropic also told Microsoft that its systems were not compromised.

Microsoft Threat Intelligence reconstructed five stages from the injected JavaScript. The sequence describes attempted actions, rather than proof that every stage succeeded on every host:

1. Module loading and reconnaissance. The injected function collected host and user information before normal extension initialization.
2. SSH access preparation. It appended an embedded Ed25519 public key labeled svc-telemetry to authorized_keys and attempted to enable the local SSH service.
3. Reverse forwarding. A separate embedded private key authenticated an outbound connection to tunnel@134[.]209[.]82[.]225, requesting a remotely allocated port forwarded to the workstation's port 22.
4. Startup persistence. It wrote platform-specific scripts and startup configuration outside the extension directory.
5. Delayed reporting. A callback attempted to POST the collected host details to hxxp://134[.]209[.]82[.]225:8099/beacon.

The two SSH identities served different purposes: the planted public key authorized access to the workstation, while the embedded private key authenticated the connection to the tunnel server.

The reporting callback sent environment-variable names rather than values. Microsoft found a limit of 40 names matching terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP; that collection alone does not demonstrate theft of the secrets stored in those variables.

Code errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts, according to Cursor's account. Enabling the local SSH service required privileges the extension generally lacked.

The loader could still add the attacker's key, install persistence, and transmit host details when the SSH setup failed. Microsoft also found that successful remote access depended on the workstation's SSH configuration and the attacker's server configuration, so a running tunnel process alone did not establish that an attacker logged in.

Cursor's published indicators identify startup artifacts designed to survive removal of the extension:

• macOS: a user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, with the script ~/.config/.smt and tunnel identity ~/.config/.smtk.
• Windows: a scheduled task named SysMon requesting SYSTEM execution, with a fallback at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd. Associated files include %USERPROFILE%\.config\smt.cmd and %USERPROFILE%\.config\smtk.

Microsoft also found a Linux @reboot persistence branch in the loader. Cursor's identified malicious package builds cover macOS and Windows.

Cursor reported three marketplace-side containment actions:

• An access audit found no other tampered extensions.
• Marketplace keys were rotated.
• The marketplace was rebuilt and brought back online after its temporary shutdown.

The hosting provider also took the attacker's server offline, disabling the external beacon and reverse connection. Cursor's public announcement asks customers to update Claude Code for VS Code to 2.1.314.

The notice does not explain how the malicious packages entered the marketplace.

Cursor's recovery procedure calls for isolating hosts with evidence of payload execution, removing unauthorized keys and persistence, stopping tunnel processes, and assessing whether a host rebuild is necessary. It also calls for rotating accessible credentials and sessions from a trusted machine, because the limited initial collection does not rule out subsequent access through the backdoor.

The company published two cleanup scripts with different execution requirements:

• remediate-macos.sh: runs as the affected user, rather than root.
• remediate-windows.ps1: runs from an administrator PowerShell session.

The scripts remove the malicious extension and associated host artifacts, and return a nonzero status if anything remains.

Cursor's quick check searches for the svc-telemetry key marker. Microsoft cautions that an absent marker alone cannot replace review of installation records, processes, network activity, and persistence evidence; it also says startup names alone are insufficient to distinguish malicious artifacts from legitimate monitoring software.