Fake Claude Code update hid an SSH backdoor — uninstalling it won't remove it

On October 29, a tampered copy of Anthropic's Claude Code extension sat in Cursor's extension marketplace for about eleven hours, from 2:27am to 1:35pm Pacific time. Versions 2.1.312 and 2.1.313 for Windows and macOS carried Anthropic's real extension name — but Cursor says Anthropic never built them, and Anthropic says its own systems were never compromised. Somebody used access to Cursor's marketplace to publish the fake build.

The poisoned extension ran the moment it loaded — no prompt, no click needed. It harvested host details, added an attacker-controlled SSH key labeled "svc-telemetry" to the machine's authorized keys, tried to switch on local SSH and open a reverse tunnel to the attacker's server, and installed startup persistence so the backdoor survives a restart. Cursor warns that uninstalling the extension may not be enough, because standalone persistence scripts keep running on their own.

Cursor pulled the builds, shut the whole marketplace down, rotated its keys, rebuilt it and got the attacker's server taken offline. BleepingComputer reported that up to 5,000 developers were exposed — and more than a week later, nobody has said publicly how the attacker got publishing access to the marketplace in the first place.