A tampered Claude Code backdoor reached Cursor users on October 29, 2026, when modified package version 2.1.313 sat in the editor’s marketplace for about 11 hours. Cursor says at most 5,000 users were affected and that this malicious version was not developed by Anthropic. Affected users are being asked to move to 2.1.314 and check for a key labeled svc-telemetry.
Key Takeaways
- Version 2.1.313 sat in Cursor’s marketplace about 11 hours on October 29.
- The build tried to plant an svc-telemetry SSH key and a reverse tunnel.
- Cursor says at most 5,000 users were affected; the version was not developed by Anthropic.
- Socket found no Open VSX or npm record for the malicious version.
What the Claude Code Backdoor Tried to Do
The package kept the real extension ID, anthropic.claude-code. Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News: “The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code.”
Phorion CEO Calum Hall explained that the injected code runs when Node loads the file, before activate, with no click required. It appends an SSH public key labeled svc-telemetry and opens a reverse tunnel that retries about every 60 seconds, including after the editor closes.
The Hacker News reported remote address 134.209.82[.]225 and unencrypted HTTP beacons to port 8099 at /beacon. Persistence uses a LaunchAgent on macOS, a reboot cron entry on Linux, and a Windows scheduled task named SysMon, with a Startup-folder fallback.
The beacon sends hostname, username, operating system, home and working directories, Git email, and public IP. It also sends the names, not the values, of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP.
Why the SSH Login Often Failed
The key helps only if SSH is already running. Enabling the service needs administrator rights the extension lacks on most macOS and Windows hosts. Cursor said that on those hosts the step fails, so the attacker could not have logged in through the tunnel.
A technology.org account notes the enable can succeed if Cursor was launched with admin rights. The rogue key, persistence, and beacon still ran. Cursor and the hosting provider then took the attacker’s server offline, stopping the tunnel and the reports.
Phorion found that on macOS the Remote Login check errors without admin rights and skips enabling SSH. Hall cautioned, in comments reported by Help Net Security, that this is not a defense if Remote Login is already on or is turned on later.
Cursor’s Marketplace, Not Open VSX
OpenSourceMalware initially reported the malicious 2.1.313 build as published to Open VSX, Socket wrote. Socket found no publication or removal record there. The Hacker News corrected an earlier Open VSX claim: the update went out only through Cursor’s marketplace.
As of October 30, Anthropic had published 2.1.314 to Open VSX and Microsoft’s VS Code Marketplace. People who installed Claude Code only from those stores are not known to be affected.
Socket reviewed 3,392 Open VSX events from October 27 through 05:35:23 UTC on October 30 and found active builds of 2.1.312 and 2.1.314, eight platforms each, and no event for 2.1.313. All 42 versions removed in that window left records, one after about 90 seconds.
Version 2.1.313 is also missing from npm metadata for @anthropic-ai/claude-code and from public GitHub releases. Socket has not analyzed the malware sample itself.
| Channel | Status of 2.1.313 |
|---|---|
| Cursor marketplace | Listed about 11 hours on October 29, then removed |
| Open VSX | No publication or removal event in Socket’s review |
| npm | Absent from the versions list and the time map |
| Microsoft marketplace | No malicious version reported |
| GitHub releases | Version skipped; changelog has no incident note |
Ax Sharma, head of research at Manifold Security, said:
Checking the publisher name doesn’t help when the publisher is real. What helps is watching behaviour: a coding extension planting SSH keys should be caught in seconds.
What Developers Should Check
The listing was up from about 2:27 a.m. to 1:35 p.m. PT on October 29. Cursor shut the marketplace, found no other tampered extensions, rotated keys, and restored the store “after confirming there is no further risk.”
Cursor said the incident does not affect other extensions from its marketplace, Grok Bot, Grok, or its other SpaceXSI product. It has no evidence other Claude Code versions or the official distribution were compromised. How the build was published remains unclear.
Uninstalling does not remove standalone scripts the payload leaves behind. Anyone who installed or updated to 2.1.313 should:
- Isolate the host and consider a rebuild.
- Remove the svc-telemetry authorized-keys entry.
- Run Cursor’s published macOS and Windows cleanup.
- Update to Claude Code 2.1.314.
- Rotate credentials from a trusted system.
- Check SSH logs for localhost use of that key, per Phorion.
Jenn Gile said: “It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware.” Cursor noted that limited data collection does not rule out later credential access through the backdoor.
For engineering managers, a publisher name fails as a control when auto-update installs the build. Pin versions, alert on new SSH keys, and review forked marketplace pipelines the way you would a LiteLLM supply-chain attack or embedded-browser flaws in AI coding tools.
