Between roughly 2:27 a.m. and 1:35 p.m. Pacific on October 29, a tampered copy of the official Claude Code extension sat in the Cursor Marketplace — versions 2.1.312 and 2.1.313, for Windows and macOS. Anyone who installed or auto-updated in that window did not get an editor helper. They got a loader that planted an SSH key, opened a reverse tunnel and wrote persistence.
Cursor published its own incident notice, took the marketplace offline, rotated keys and rebuilt it. The attacker's server has been taken down. Microsoft analyzed the injected JavaScript and shipped detections. Anthropic confirmed to Microsoft that its own systems were not compromised and that it did not produce the malicious package; the Visual Studio Marketplace and the npm package were unaffected.
What the loader actually does
Stage one is reconnaissance. When the module loads, before normal initialization, it collects the hostname, username, operating system, architecture, home directory, working directory, configured Git email and public IP. It also scans environment variables for names containing KEY, TOKEN, SECRET, PASS, AWS or GCP, keeping up to 40 matches. Worth noting for damage assessment: it sends variable names, not values.
Stage two is access. The loader checks authorized_keys for the comment svc-telemetry. If it is missing, it appends an embedded Ed25519 public key — an authorization for whoever holds the matching private key. It then decodes a second, separate key for the outbound connection, writes it to a hidden file matching .stk_ plus ten hex characters, and starts an SSH connection with host-key checking disabled (StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null) that forwards a server-assigned remote port back to local port 22.
Stage three is persistence. On macOS a LaunchAgent named com.apple.sysmond.plist — a name impersonating an Apple system service; on Linux a @reboot crontab entry; on Windows a scheduled task called SysMon seeking SYSTEM rights, with a Startup-folder batch fallback. If the tunnel dies, it retries roughly every 60 seconds.
How far did it get?
Less far than the code intended — but not harmlessly. Enabling the local SSH service requires administrator rights the extension did not have on most macOS and Windows hosts, and Cursor says that step failed there. What remained: the appended key, the persistence artifacts, and the reported host details.
That is the actual lesson. An attack that fails to open the door can still change the lock. And because the payload writes scripts outside the extension directory, uninstalling the extension is not remediation — which is where a lot of cleanup attempts will go wrong.
Check and clean up
The marker is the key comment. On macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "key found" || echo "clean"
On Windows, check %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. Anyone who finds the marker should treat the machine as compromised: remove the unauthorized key, remove persistence artifacts and running tunnel processes, and rotate credentials from a clean system. Cursor published platform scripts that exit non-zero if anything remains.
What this says about extension marketplaces
Neither Anthropic nor the JavaScript was the weakest link. The assumption that a marketplace is a trusted source was. An extension runs with a developer's privileges, updates itself automatically, and can reach the filesystem, the environment and running processes. One compromised publishing path is enough.
Microsoft's recommended controls are the ones package ecosystems learned the hard way: restrict extensions to approved publishers and set an installation cooldown so a freshly published malicious version does not reach every machine at once. For teams with many developers, that cooldown is not paranoia. It is the only control between published and installed.
