Trojanized Claude Code Extension on Cursor's Marketplace Planted an SSH Backdoor: How to Check and Clean Up

Cursor says a tampered build of the anthropic.claude-code extension was available in its VS Code extension marketplace for roughly 11 hours on 29 October 2026, from about 2:27 a.m. to 1:35 p.m. PT. Versions 2.1.312 and 2.1.313 for Windows and macOS carried a loader that tries to add an attacker SSH key labelled svc-telemetry, open a reverse tunnel and set up persistence. Press coverage puts the exposure at up to 5,000 users, a figure The Hacker News attributes to Cursor. Version 2.1.314 is the fixed release.

Who said what

Cursor's notice states that "these malicious versions of the extension were not developed by Anthropic" and that it has no evidence other versions or the official distribution are affected. It removed the builds, shut the marketplace down temporarily, rotated keys and rebuilt it, and says the attacker server is offline. Anthropic engineers David Dworken and Felix Rieseberg said on X, as reported by The Hacker News, that Anthropic's systems and employee laptops were not compromised and that official channels are unaffected. Anthropic's GitHub release notes for 2.1.314 (30 October) do not mention the incident, and Microsoft published its analysis the same day. Microsoft says the Visual Studio Marketplace and the npm package @anthropic-ai/claude-code were not affected. How the attacker published under Anthropic's identity is not yet explained.

What the loader does

A loader was inserted at the start of the extension's extension.js and runs when the extension loads. In order, per Microsoft: it profiles the host; appends the svc-telemetry key to authorized_keys and tries to enable SSH; starts ssh -N -R '*:0:localhost:22' to 134.209.82.225, retrying every 60 seconds; writes persistence; and later beacons to http://134.209.82.225:8099/beacon. The beacon carries public IP, hostname, username, OS, home directory, git email and the names (not values) of environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. Cursor says the SSH step probably failed on most hosts because it needs admin rights, but the key and persistence can still be written. Uninstalling the extension removes none of these artifacts.

The malicious builds were live for roughly 11 hours on 29 October; the fixed 2.1.314 and Microsoft's analysis followed on 30 October.

Indicators

• Key comment svc-telemetry, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
• IP 134.209.82.225 (TCP 22 and 8099)
• extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
• Hidden temporary key files named .stk_ plus 10 hex characters
• Cursor lists VSIX hashes for 2.1.312 and 2.1.313 (darwin-arm64, win32-x64) in its notice

Check and clean up

Preserve evidence first (copy authorized_keys, the scripts and the plist or task definition), and isolate any host with signs of execution. Do the work as the affected user, not root.

macOS

grep -s svc-telemetry ~/.ssh/authorized_keys
ls -l ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk
ps aux | grep -E "autossh|ssh -N -R" | grep -v grep
# after inspecting the plist and recording evidence:
launchctl unload ~/Library/LaunchAgents/com.apple.sysmond.plist
rm ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk

Then delete only the svc-telemetry line from authorized_keys. Check whether Remote Login was switched on (the loader used systemsetup -setremotelogin on) and turn it off if you did not enable it. Cursor also publishes a remediate-macos.sh script; review it before running.

Windows (PowerShell)

Select-String -Path "$HOME\.ssh\authorized_keys","C:\ProgramData\ssh\administrators_authorized_keys" -Pattern svc-telemetry
Get-ScheduledTask -TaskName SysMon | Select-Object -ExpandProperty Actions
# as Administrator, after recording evidence:
Unregister-ScheduledTask -TaskName SysMon -Confirm:$false
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd","$env:USERPROFILE\.config\smt.cmd","$env:USERPROFILE\.config\smtk"

Cursor ships remediate-windows.ps1 for an elevated prompt.

Linux

Cursor names Windows and macOS as the affected builds, but its IOC list and Microsoft's analysis include Linux paths, so check anyway.

grep -s svc-telemetry ~/.ssh/authorized_keys
crontab -l | grep -F .smt
ls -l ~/.config/.smt ~/.config/.smtk

Remove only the matching @reboot line with crontab -e, delete the two files, and remove the svc-telemetry key line.

All systems: compare the key against the fingerprint before deleting, keep unrelated keys, search the user profile for .stk_* files, stop any ssh -N -R process, reboot and re-check. Search network logs from 29 October for 134.209.82.225. Rotate credentials and sessions reachable from any affected host, using a clean machine; Cursor says rebuilding the host may be warranted. Install 2.1.314 or later, and consider limiting extensions to approved publishers with an install cooldown on new versions.

Sources

• Cursor security notice
• Microsoft Security: Inside the malicious Claude Code-branded Cursor extension
• The Hacker News
• Claude Code v2.1.314 release
• BleepingComputer