A tampered copy of Anthropic's Claude Code VS Code extension was available on Cursor's marketplace for roughly 11 hours on Oct. 29 and tried to install a persistent SSH backdoor, Cursor and security firms said^2,3,1.

Cursor said at most 5,000 users installed the malicious version between about 2:27 a.m. and 1:35 p.m. PT, and that the build was not developed by Anthropic^2,3. The Hacker News said the package used the official anthropic.claude-code identifier as version 2.1.313 with an injected JavaScript loader². Wired said Cursor published remediation steps for roughly 5,000 affected targets⁵.

Phorion said Cursor later listed 2.1.312 and 2.1.313 as affected and removed them¹. Researchers said the code added an attacker SSH key labeled svc-telemetry, installed persistence, opened a reverse tunnel to 134.209.82.225 and sent host details to that server^1,2,3.

Phorion and BleepingComputer said bugs often blocked turning SSH on: macOS Remote Login checks failed without admin rights, and Windows setup called /bin/sh^1,3. Cursor still advised remediation because keys, persistence and beacons were planted^2,3.

The Hacker News said there was no evidence the malicious build reached Open VSX or Microsoft's VS Code Marketplace, and that Anthropic published 2.1.314 there². Ars Technica said it remains unknown how attackers obtained access to the verified Cursor publisher account⁴. An early DoublePulsar post framed Anthropic as compromised; later reporting located the distribution on Cursor's marketplace^6,2.

Cursor said it would contact affected users². Whether any successful SSH logins occurred, and which organization's systems were used to publish the package, were not established in the reports reviewed^4,3.