Cursor says a modified Claude Code extension reached at most 5,000 users in about 11 hours. The SSH step likely failed on most machines, but the scripts it dropped keep running after removal.
A modified copy of the Claude Code extension, version 2.1.313, was available in Cursor's extension marketplace from about 2:27am to 1:35pm Pacific time on 29 October. That is about 11 hours. Cursor's security notice says at most 5,000 users were affected and that the extension "was not developed by Anthropic".
What the code did
The SSH backdoor mostly failed. Cursor says the code tries to add an attacker's key to authorized_keys, switch on the local SSH service and open a reverse SSH tunnel. "Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail."
The rest of the payload does not depend on that step. Cursor says it collects the hostname, username, operating system, home directory, environment variable names, working directories, Git email and public IP address. It then reports them by HTTP POST to /beacon on port 8099.
The persistence step is what survives removal. Cursor says the payload installs a LaunchAgent on macOS, or a scheduled task that attempts to run as SYSTEM with a Startup script fallback on Windows. Its background scripts retry the tunnel roughly every 60 seconds. Its notice warns that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts.
Researchers at Phorion and OpenSourceMalware, quoted by BleepingComputer, found a malicious JavaScript loader at the start of extension.js, with the legitimate code otherwise unchanged. Phorion says coding errors likely stopped attackers gaining remote access to many affected systems. The key install, persistence and reconnaissance beacon still occur.
How to check your machine
Anyone who installed or updated the extension through Cursor on 29 October can check the indicators Cursor and Phorion published. On macOS, look for a new LaunchAgent. On Windows, look for a new scheduled task or Startup script. Check authorized_keys for a public key labelled "svc-telemetry".
Network logs give a second check: traffic to 134.209.82[.]225, or to port 8099 with a /beacon path. A downloaded VSIX package can also be compared with Cursor's SHA-256 hashes. For darwin-arm64 it is fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364. For win32-x64 it is 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081.
If anything matches, removing the extension is only the first step. The persistence scripts need deleting separately. Cursor says the attacker server no longer functions, but the scripts keep retrying roughly every 60 seconds until they are gone.
How it reached users
Cursor is the only confirmed channel. Early reports named Open VSX, npm and Microsoft's VS Code Marketplace. But Socket found "No events for 2.1.313" in 3,392 Open VSX change feed events. Its npm check shows 2.1.312 and 2.1.314 but no 2.1.313. The first OpenSourceMalware analysis has since been substantially revised and no longer names Open VSX.
Cursor says it removed the version, shut down and rebuilt the marketplace, rotated keys and confirmed no other extensions were tampered with.
CTOL's view is that the incident is narrower than the first reports and more durable than the SSH failure suggests. The evidence is Cursor's account of a failing SSH step beside persistence scripts that sit outside the extension, which Phorion's findings back. The 5,000 figure is Cursor's ceiling for affected users, and no install count has been published.
The observable test is Cursor naming how the package reached its marketplace and replacing "at most 5,000" with a count of machines that ran it. A later Socket or Open VSX update would show whether any other channel carried 2.1.313.