On October 29, versions 2.1.312 and 2.1.313 of the Claude Code VS Code extension were replaced with backdoored builds on the Cursor marketplace. The exposure window was approximately 11 hours, from 09:27 to 20:35 UTC. Cursor confirmed up to 5,000 developers may have installed the malicious version before the package was removed.
What the backdoor does
The payload uses a six-stage loading sequence designed to evade signature-based detection. Each stage decodes and executes the next. The final payload performs four operations on the victim machine.
First, it adds an attacker-controlled SSH public key to the current user's authorized_keys file. This grants persistent SSH access that survives reboots and password changes.
Second, it enables the SSH daemon if disabled. This ensures the backdoor channel remains active even on machines configured to not accept inbound SSH connections.
Third, it opens a reverse SSH tunnel to the attacker's command-and-control server on a 60-second polling interval. Machines behind NAT or firewall rules that block inbound SSH are still reachable via this outbound tunnel.
Fourth, it installs cross-platform persistence: a cron job on Linux, a LaunchAgent plist on macOS, and a Scheduled Task on Windows. Removing the extension does not remove the persistence mechanism.
Timeline and response
The C2 infrastructure was taken offline on October 30, approximately 24 hours after the exposure window opened. Cursor issued a security advisory and began notifying affected users. Anthropic confirmed the incident publicly, with Felix Rieseberg and David Dworken from Anthropic's security team leading disclosure. StepSecurity conducted independent artifact analysis.
Who is at risk
Any developer who had the Claude Code extension installed in Cursor and received an automatic update between 09:27 and 20:35 UTC on October 29 should assume their machine is compromised. Extension auto-update is on by default in Cursor, so the affected window is not limited to developers who manually initiated an update during those hours.
Remediation steps
Do not only uninstall the extension. The persistence mechanism survives extension removal. On each potentially affected machine: audit authorized_keys files for unknown entries, disable and review the SSH daemon configuration, inspect cron jobs, LaunchAgent plists, and Scheduled Tasks for unknown entries, and rotate all secrets and credentials stored on or accessible from that machine.
Treat any credentials accessible from an affected developer machine as compromised. That includes cloud provider API keys, code signing certificates, internal service tokens, database credentials, and SSH keys to other systems. Rotate before restoring network connectivity.
The broader lesson
Developer tooling is high-value supply chain real estate. A developer's machine typically has access to source code repositories, cloud environments, CI/CD pipelines, and internal services. A single compromised IDE extension achieves a foothold with a blast radius far larger than a compromised end-user workstation. Marketplace publishers need to sign artifacts, pin builds to verified content hashes, and implement anomaly detection on download volume. Developers need to treat extension auto-update as a security-relevant configuration, not a convenience default.
Gigia Tsiklauri covers threat intelligence and security operations at Infosec.ge