Cursor Extension Backdoor: A Fake Claude Code Package Hit 5,000 Developers

A Cursor extension backdoor spent more than 11 hours in a public marketplace this week, and up to 5,000 developers may have installed it without a second thought.

According to Techzine, version 2.1.313 of a package named Anthropic.claude-code appeared in Cursor’s extension marketplace on October 29, 2026. Cursor says Anthropic did not build that version. It looked official, it carried a trusted name, and it quietly opened a door into developer machines.

Developer laptops are where source code, cloud keys and production access all meet. That makes them a very attractive target.

What the Malicious Package Actually Did

The behavior is worth reading closely, because it is a clean example of a modern supply chain attack.

First, it collected basic system details: hostname, username, operating system, the configured Git email, the names of environment variables and the public IP address. Environment variable names alone can reveal which cloud services and secrets a developer uses.

Second, it added an attacker’s SSH key, labeled “svc-telemetry”, to the authorized_keys file. That label is clever. It looks like boring monitoring plumbing, the kind of entry a busy engineer would not question.

Third, it tried to switch on the local SSH service and open a reverse tunnel to the attacker’s server. For persistence it used a LaunchAgent on macOS and a scheduled task on Windows, with a startup script as fallback. Background scripts tried to reconnect roughly every 60 seconds.

Why It Was Less Damaging Than It Could Have Been

There is a bit of luck in this story. Turning on SSH needs admin rights, which an extension normally does not have. A bug meant that step only worked if Cursor was launched as administrator. Still, the SSH key placement, the persistence mechanisms and the forwarding of host data did succeed.

That detail is the real lesson. The attacker did not need everything to work. A leaked hostname, a planted key and a self-restarting script are enough to start a longer campaign.

How Cursor Responded

Cursor removed the bad version and blocked further distribution. It took the entire marketplace offline as a precaution, verified access, rotated keys and rebuilt it before bringing it back. It also had the attacker’s server taken down with the cloud provider and says it found no sign that other extensions or versions were affected. Affected users are being contacted directly.

That is a solid response. It is also a reminder that marketplaces are trust systems, and trust can be borrowed by anyone who copies a name.

What to Do If You Installed It

Do not assume uninstalling the extension fixes things. The payload left standalone scripts that keep running on their own.

Check for the “svc-telemetry” key in your authorized_keys file. On macOS a simple grep does the job, and on Windows Cursor provides a PowerShell script. If the key is there, isolate the machine, run Cursor’s remediation scripts and rotate credentials and sessions from a clean, trusted device. Admins should decide whether the machine needs a full rebuild.

Rotate more than you think you need to. Cloud keys, Git tokens, package registry tokens and SSH keys are all fair game.

Hardening Your Developer Environment

Let me be direct: relying on marketplace review alone is not a security strategy. Here is what works better.

Pin and allowlist extensions. Teams should maintain an approved list and block everything else through managed settings. Verify the publisher, not just the display name.

Keep secrets out of laptops where you can. Short-lived credentials, hardware-backed keys and cloud secret managers shrink the damage when a workstation is compromised.

Watch for odd persistence. New LaunchAgents, unexpected scheduled tasks and unfamiliar entries in authorized_keys should trigger alerts. Endpoint tools can catch these patterns if someone writes the rules.

On the package side, GitHub recently launched an npm package firewall to block supply chain attacks, as TechJuice covered. Guidance from OWASP and the SLSA framework is a good place to start for build integrity, and the MITRE ATT&CK knowledge base maps these persistence tricks in detail.

The Bigger Pattern: AI Tooling as an Attack Surface

This attack used the name of a popular AI coding assistant on purpose. Attackers go where developers are rushing, and right now developers are rushing toward AI tools. New extensions, agents and plugins appear weekly, and each one asks for deep access to your code and shell.

So treat AI developer tooling like any other privileged software. Review what it can read, what it can run and where it sends data. Speed is great. Blind trust is not.

Key Takeaways

• Scale and timing: a fake version of the Claude Code extension sat in Cursor’s marketplace for over 11 hours, with up to 5,000 users potentially affected.
• Persistence was the goal: an SSH key named “svc-telemetry”, reverse tunnels and OS-level startup tasks aimed at long-term access.
• A bug limited the damage: SSH enabling needed admin rights, but key planting and data collection still worked.
• Uninstalling is not enough: check for the planted key, run remediation and rotate credentials from a clean machine.
• Allowlist extensions: managed lists and publisher checks beat hoping the marketplace catches everything.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development, AI integration, or cloud migration, our team builds scalable solutions with secure development practices built in. Talk to our experts.

How many extensions are installed on your developers’ machines right now, and who approved them?