Eleven Hours, Up to 5,000 Developers: A Tampered Claude Code Extension Quietly Opened an SSH Back Door. The Timeline and the Cleanup
A tampered version of Anthropic’s Claude Code extension, 2.1.313, was offered through Cursor’s extension marketplace for about 11 hours on October 29 and planted an SSH backdoor on machines that installed it. Uninstalling is not enough. Here is what happened, hour by hour, and how to clean up.
Developers who use AI coding assistants inside their editors got an unwelcome reminder on Thursday that extensions are software too, with all the supply chain risk that comes with it. A malicious build of Anthropic’s official Claude Code extension, version 2.1.313, was distributed to users of the Cursor editor for roughly 11 hours. Anyone who installed or auto-updated to it may have had a hidden remote access door added to their machine.
The details here come from The Hacker News’ report on the compromised extension, which was updated to reflect Cursor’s account of how it happened, and from Help Net Security.
The timeline
- October 29, about 2:27 a.m. Pacific: the tampered version 2.1.313 becomes available through Cursor’s extension marketplace. Cursor says the tampered build was not developed by Anthropic, and the incident has been traced to a compromise of Cursor’s own marketplace. (Some early reports pointed to the Open VSX registry instead.)
- About 1:35 p.m. Pacific: the bad version is pulled. Cursor estimates that no more than 5,000 users were exposed and says it will contact them.
- Afterward: Cursor shut down its marketplace as a precaution, audited access and found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back. It also worked with a cloud provider to take the attacker’s server offline. Anthropic published a clean version, 2.1.314.
What the extra code did
The attacker added a loader to the top of the extension’s main file, so it ran as soon as the file was loaded, before the extension’s normal startup code and without the user doing anything. According to the researchers, it:
- Added an SSH key labeled svc-telemetry to the list of keys allowed to log in to the computer.
- Opened a reverse SSH tunnel to a server controlled by the attacker, retrying about every 60 seconds and continuing to run after the editor was closed.
- Set itself up to survive a restart: a LaunchAgent with an Apple-style name on macOS, a cron job that runs at reboot on Linux, and a scheduled task named SysMon on Windows (or a Startup folder entry if that failed).
- Sent the attacker basic details about the machine, including the hostname, username, operating system, home and working folders, Git email address, public IP address and the names, but not the values, of up to 40 environment variables containing words such as KEY, TOKEN, SECRET or PASS.
No follow-on payloads have been reported. One limiting factor: the SSH door only works if the computer’s SSH service is turned on, and turning it on requires administrator rights that the extension lacked on most Mac and Windows systems.
The cleanup checklist
Researchers stress that uninstalling the extension does not remove the back door, because the key, tunnel and startup entries live outside the editor. For any computer that ran version 2.1.313:
- Disconnect it from the network until it has been checked.
- Remove the svc-telemetry key from the SSH authorized keys file and delete the LaunchAgent, cron entry or SysMon scheduled task. Consider rebuilding the machine entirely.
- Check SSH logs for logins from localhost using that key, which would suggest the tunnel was used.
- From a separate, trusted computer, rotate the passwords, tokens, API keys and active sessions that were present on the affected machine.
- Update to Claude Code 2.1.314 or later once the machine is clean.
What this means for your company
Editor extensions, browser add-ons and AI coding tools often run with the same access as the person using them, and many update automatically. If your staff or contractors write code, keep an inventory of the extensions they use, limit installation to an approved list where you can, and make sure developer laptops are covered by the same endpoint monitoring as everything else. Keeping secrets out of plain environment variables and rotating them on a schedule also shrinks the payoff when a tool goes bad.
Do you know which extensions and AI tools are running on your developers’ machines today? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
