The backdoored Claude Code 2.1.313 build in Cursor's marketplace, explained Cursor reported that a modified build of Anthropic's Claude Code extension, version 2.1.313, sat in its VS Code extension marketplace for about 11 hours on October 29, 2026 โ€” from roughly 2:27am to 1:35pm Pacific (09:27 to 20:35 UTC) โ€” and reached at most 5,000 users, with Cursor stating Anthropic did not build it. The loader runs as soon as the editor loads the extension, adds an attacker SSH key labelled svc-telemetry, sets up a startup task, attempts to enable SSH, opens a reverse tunnel and reports host details to 134.209.82.225, though Cursor says the SSH step likely failed on most Macs and Windows PCs for lack of admin rights. Checks of Open VSX, the Microsoft marketplace and npm on October 30 found all three jump from 2.1.312 to 2.1.314, which Anthropic published between 00:12 and 01:20 UTC that day, and Cursor says uninstalling is not enough โ€” users must run its remediation script and rotate credentials from a clean machine. The backdoored Claude Code 2.1.313 build in Cursor's marketplace, explained: what it installs, which registries were clean, and how to check every machine On October 29, 2026, Cursor said a modified build of Anthropic's Claude Code extension sat in its extension marketplace for about 11 hours and reached at most 5,000 users. We queried the public registries ourselves, merged the indicators Cursor and the researchers published into one checklist per operating system, and explain why uninstalling the extension does not remove what it planted. This explains reporting by Cursor, "Security notice: malicious version of Anthropic.claude-code 2.1.313 identified in the Cursor Extension Marketplace" October 29, 2026 https://cursor.com/blog/claude-code-extension-security-notice . Read the original first: https://cursor.com/blog/claude-code-extension-security-notice https://cursor.com/blog/claude-code-extension-security-notice In one minute - Cursor says a modified Anthropic.claude-code 2.1.313 was in its VS Code extension marketplace from about 2:27am to 1:35pm Pacific on October 29, 2026, which is 09:27 to 20:35 UTC. At most 5,000 users got it. Cursor says Anthropic did not build it. - The loader runs as soon as the editor loads the extension, before any Claude conversation. It adds an attacker SSH key labelled svc-telemetry, sets up a startup task, tries to turn on SSH, opens a reverse tunnel and reports host details to 134.209.82.225. - The report includes the names of environment variables that look like keys or tokens, not their values, per Phorion's analysis. A working tunnel would expose everything the user can read. - Turning on SSH needs admin rights the extension does not have, so Cursor says the tunnel step likely failed on most Macs and Windows PCs. Machines where SSH was already on carry the real risk. - We checked the public registries on October 30: Open VSX, the Microsoft marketplace and npm all go from 2.1.312 to 2.1.314, which Anthropic published between 00:12 and 01:20 UTC on October 30. - Uninstalling is not enough. Run Cursor's remediation script for your platform, then rotate credentials from a clean machine. What happened, in order Cursor is a code editor built on VS Code, and it installs extensions from its own marketplace. Cursor's notice says a modified version of Anthropic.claude-code, version 2.1.313, was available there from about 2:27am to 1:35pm Pacific time on October 29, 2026. Pacific time was UTC minus 7 that day, so the window is 09:27 to 20:35 UTC. Cursor says it removed the version, shut the marketplace down, audited access, rotated its keys, rebuilt the marketplace and brought it back online. It says no other extensions were tampered with, at most 5,000 users were affected, and it will contact them directly. It also says the attacker's server no longer works, after it worked with the hosting provider to take it down. How the build got into the marketplace is not public. Cursor's notice does not say, and The Hacker News reports that the method remains unclear. Early reports said the bad build came through Open VSX, the open extension registry many VS Code-based editors use. The Hacker News and the OpenSourceMalware researchers both corrected that: the build was traced to Cursor's marketplace. We checked the public registries ourselves On the morning of October 30 we asked each public registry for its version list of the Claude Code extension and package. October 30, 2026, about 09:40 MDT Open VSX GET https://open-vsx.org/api/Anthropic/claude-code/versions 2.1.314, 2.1.312, 2.1.311, 2.1.310, ... no 2.1.313 2.1.314 published 2026-10-30 01:07 UTC Microsoft POST marketplace.visualstudio.com/ apis/public/gallery/extensionquery anthropic.claude-code: 2.1.314, 2.1.312, 2.1.311, ... no 2.1.313 2.1.314 builds published 01:16 to 01:20 UTC on 2026-10-30 npm GET https://registry.npmjs.org/@anthropic-ai/claude-code 2.1.312 2026-10-27 18:36 UTC 2.1.314 2026-10-30 00:12 UTC no 2.1.313 entry StepSecurity wrote that 2.1.313 was briefly listed on the Microsoft marketplace and now returns 404. We could not confirm or rule that out from today's data, because a removed version leaves no entry in the list. So treat a 2.1.313 install from any source as bad. The skipped number matters for a quick check. If an extension list on a machine shows anthropic.claude-code at 2.1.313, that build did not come from any public registry we queried. What the loader does, step by step This part comes from Phorion's analysis, with Cursor's notice confirming the outline. - It runs first. A block of code sits at the top of extension.js, so it runs when the editor loads the file, before the extension's own start code. OpenSourceMalware counted 66 lines. No prompt or click is needed. - It adds a door. It appends an attacker's Ed25519 public key, labelled svc-telemetry, to ~/.ssh/authorized keys. Anyone with the matching private key can then log in as you, if your SSH service is reachable. - It tries to open the door. It tries to turn on SSH with systemctl on Linux, systemsetup on macOS and PowerShell on Windows. Phorion says these steps carry no privilege escalation and often fail for a normal user. - It calls home through a tunnel. It opens an outbound SSH connection to 134.209.82.225 as user tunnel and asks that server to forward a port back to your port 22. That is a reverse tunnel: the attacker reaches your SSH through a connection your own machine started, so a home router or an office firewall that blocks incoming traffic does not stop it. It retries every 60 seconds. - It survives a restart. On macOS it writes a LaunchAgent named com.apple.sysmond.plist, a name chosen to look like Apple's. On Linux it adds an @reboot cron entry. On Windows it creates a SYSTEM scheduled task named SysMon, with a Startup-folder fallback. - It reports in. It sends one JSON message over plain HTTP to port 8099 with the hostname, username, operating system, home folder, global Git email, public IP and up to 40 environment variable names that match KEY, TOKEN, SECRET, PASS, AWS or GCP. Phorion says the values are not sent. Why uninstalling does not fix it The extension is only the delivery truck. The SSH key, the startup task and the hidden files in ~/.config live outside the extension folder, so removing the extension leaves them in place. Cursor's notice says the payload drops standalone persistence scripts that keep running. That is why Cursor ships two scripts: remediate-macos.sh, run as the affected user and not as root, and remediate-windows.ps1, run from an elevated PowerShell. Both exit with an error if anything is left. Cursor's notice lists no Linux script; Phorion lists the Linux cron entry to remove by hand. Who is really at risk The key and the startup task are installed either way. Whether an attacker could actually log in depends on one question: was SSH already accepting connections on that machine? If SSH was off, the loader had to turn it on, and that needs admin rights it does not have. So Cursor says the tunnel step likely failed on most macOS and Windows hosts. Phorion also found a bug in the macOS path: run without root, the systemsetup check prints an error instead of the word Off, so the script never tries to enable Remote Login at all. If SSH was already on, for example a Linux machine running sshd or a Mac with Remote Login enabled, the tunnel could connect and the planted key would let the attacker in as you while the attacker's server was up. Treat that machine as compromised and follow Cursor's advice to consider a rebuild. In every case the report went out, so the attacker may hold the hostname, username, Git email, public IP and the names of secret environment variables. Names are not keys, but they tell an attacker what to look for. How to check a machine Cursor's quick check for macOS, written here so it also prints when nothing is found. It works the same in a Linux shell: grep -qs svc-telemetry ~/.ssh/authorized keys && echo "svc-telemetry key found" || echo "not found" More places to look, from Cursor's and Phorion's indicators: - Extension folder: anthropic.claude-code-2.1.313-