A Claude Code extension on Cursor's marketplace shipped an SSH key Anthropic never wrote

Cursor took its extension marketplace offline on 29 October after finding that versions 2.1.312 and 2.1.313 of Anthropic.claude-code, listed there for Windows and macOS, were not built by Anthropic. The company put the exposure window at 09:27 to 20:35 UTC. The build collected host details, installed an attacker's SSH key and tried to hold a tunnel open.

What the tampered build did

Cursor's security notice describes a payload that maps the machine first: hostname, username, operating system, architecture, home directory, environment variable names, working directories, the Git config email and the public IP. It then appends a key labelled svc-telemetry to authorized_keys, attempts to switch on local SSH and open a reverse tunnel, and writes persistence that outlives an uninstall: a LaunchAgent on macOS, a scheduled task on Windows that tries to run as SYSTEM. A background script retries the tunnel roughly every 60 seconds. Phorion's teardown found the injected block prepended to the minified extension.js, so it runs when Node loads the file, before activate.

The backdoor tripped over its own code

The persistence is the alarming part. The access is the part that mostly did not happen. Turning on SSH needs administrator rights the extension did not have, so on ordinary machines the key landed in authorized_keys and nothing used it. Cursor concedes it failed outside "highly unusual circumstances where Cursor was started with administrator privileges". Phorion found the attempt broken by the attackers themselves. On macOS the script tests remote login with systemsetup -getremotelogin without root, gets an administrator-access error and exit code zero, so its /Off/ comparison never matches and the step is skipped. The Windows path calls a helper that hardcodes /bin/sh. Host details were still collected, the key still written, the persistence files left behind.

Nobody has explained the door

Cursor does not say how a build Anthropic never published reached a listing carrying Anthropic's name. The notice says the marketplace was shut, access audited, other extensions cleared, keys rotated and the service rebuilt. The attacker's server at 134.209.82.225 was taken offline with its hosting provider, according to Cursor, which says it has no evidence other versions or the official distribution were touched. Uninstalling may not be enough, it warns, because the payload drops standalone scripts. The shape echoes the Litellm PyPI backdoor a week earlier: a trusted name, a publishing path nobody watched.

Reach is second-hand: Sophos X-Ops reported on 30 October that Cursor "estimates that up to 5,000 users were affected", an estimate, not a count of confirmed hosts. A Hacker News submission reached 676 points and 433 comments. Per-host telemetry, how many machines accepted the key, enabled SSH and opened a tunnel, is what would settle impact. Nobody has published it.