If you updated the Claude Code extension in Cursor on October 29, you may have an SSH backdoor on your machine right now
A coding extension has everything a developer has: repos, credentials, SSH keys. An official marketplace and a name you trust are the delivery mechanism, not a safeguard.
Two malicious versions were live on Cursor’s own marketplace for about 11 hours, and neither was built by Anthropic.
Cursor reports that versions 2.1.312 and 2.1.313 of the Claude Code extension were served through its marketplace on October 29, on Windows and macOS. The payload installed a persistent SSH backdoor. Cursor has removed the versions and rebuilt the marketplace.
My read: a coding extension has everything a developer has: repos, credentials, SSH keys. An official marketplace and a name you trust are the delivery mechanism, not a safeguard.
Your pick: check whether 2.1.312 or 2.1.313 was installed or updated during the window, not just what version you’re on now. Run Cursor’s platform-specific checks, including the one for the attacker key labelled “svc-telemetry”. If you find it: isolate the host, follow Cursor’s remediation, rotate every credential and session that machine could reach from a different trusted device, and decide whether to rebuild. Uninstalling the extension alone can leave the persistence behind.
12 months: extension provenance gets real scrutiny.
24 months: developers demand narrower permissions for editor extensions.
36 months: AI-tool supply chains are routine security-review material.
Why I may be wrong: exposure isn’t the same as compromise, and bugs in the malware itself limited its impact. That’s a reason to check, not a reason to skip it.
What’s in your extension update history from the 29th?