A FAKE CLAUDE UPDATE INSTALLED A BACKDOOR IN 5,000 CODERS' MACHINES

A trojanised build of Anthropic's official Claude Code extension, version 2.1.313, was distributed through Cursor's extension marketplace as a routine update between about 2:27 a.m. and 1:35 p.m. PT on October 29, reaching at most 5,000 users before Cursor pulled it and temporarily shut the marketplace down to clean up.

The package carried a 66-line loader stitched in front of the real code. It added an attacker-controlled key labelled “svc-telemetry” to the user's authorized_keys file, tried to open a reverse SSH tunnel, installed persistence on Windows, macOS and Linux, and beaconed host details — IP address, hostname, username, operating system and the names of environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP — to an attacker server.

Cursor says the build was not developed by Anthropic, and that turning on the local SSH service needs administrator rights the extension lacked on most macOS and Windows hosts, so that step failed there. The key, the persistence and the beacon still landed, so affected users are told to remove them and rotate credentials regardless.