---
title: "Fake Claude Code extension on Cursor's marketplace left an SSH backdoor: what to check"
url: https://hernandez.systems/en/articles/fake-claude-code-extension-on-cursors-marketplace-left-an-ssh-backdoor-what-to-check
lang: en
type: NewsArticle
section: AI
published: "2026-10-31T16:04:02+00:00"
modified: "2026-11-02T15:01:21+00:00"
publisher: Osky Networks
image: https://oskydj.sfo3.cdn.digitaloceanspaces.com/calamardo/news_item/2026-10-31/e41-portada2-75b2a88b.png
alternate_es: https://hernandez.systems/es/articulos/extension-falsa-de-claude-code-en-el-marketplace-de-cursor-dejaba-una-puerta
---

# Fake Claude Code extension on Cursor's marketplace left an SSH backdoor: what to check

> If you use Cursor and have the Claude Code extension installed, stop what you're doing and check your machine. On October 29, 2026, for about eleven hours, the Cursor Extensions Marketplace distributed a tampered copy of Anthropic.claude-code, versions 2.1.312 and 2.1.313 for macOS and Windows, which tries to leave an SSH backdoor on your computer. Cursor has already pulled those versions and taken down the attacker's server, but there's one detail that changes everything: uninstalling the extension does not clean up your machine. The malicious code leaves persistence scripts behind that keep running on their own.

If you use Cursor and have the Claude Code extension installed, stop what you're doing and check your machine. On October 29, 2026, for about eleven hours, the Cursor Extensions Marketplace distributed a tampered copy of **Anthropic.claude-code**, versions **2.1.312 and 2.1.313** for macOS and Windows, which tries to leave an SSH backdoor on your computer. Cursor has already pulled those versions and taken down the attacker's server, but there's one detail that changes everything: **uninstalling the extension does not clean up your machine**. The malicious code leaves persistence scripts behind that keep running on their own.

## What happened

The security firm Phorion spotted the package and published a technical analysis. Cursor then published its security notice. According to Cursor, the malicious version was available **between 2:27 am and 1:35 pm Pacific time on October 29**. The company makes clear that those versions "were not developed by Anthropic."

Felix Rieseberg, from Anthropic, confirmed on Hacker News that there was no intrusion into Anthropic's systems or employee laptops. Someone used access to Cursor's marketplace to publish a doctored copy of the extension. According to him, the versions from Anthropic's official channels are not affected and the problem only touches Cursor users.

What neither notice explains yet is **how the attacker got that access**. Cursor says it audited access, confirmed that no other extension was altered, rotated its keys, rebuilt the marketplace and put it back online. It also shut it down completely for a while, as a precaution.

## What the malicious code does

According to Phorion, the attacker inserted a block of code at the top of the `extension.js` file. The rest of the package is the normal extension, with its interface and features. That block runs as soon as the editor loads the file, before the `activate` function: **you don't need to open or use the extension for it to fire**. The chain has four steps:

1. **Planted SSH key.** It adds an Ed25519 public key belonging to the attacker to `~/.ssh/authorized_keys`, with the comment `svc-telemetry`.
2. **Local SSH server.** It tries to turn it on: on Linux with `systemctl`, on macOS with `systemsetup`, and on Windows by installing OpenSSH Server with PowerShell.
3. **Reverse tunnel.** It opens an outbound SSH connection to the attacker's server with `-R *:0:localhost:22`. That way the operator can come back through that tunnel and reach port 22 on your machine, even if you're behind a NAT or a firewall that doesn't accept inbound connections. The tunnel retries every 60 seconds and survives even if you close the editor.
4. **Persistence.** On macOS it installs a LaunchAgent disguised as an Apple component (`~/Library/LaunchAgents/com.apple.sysmond.plist`). On Windows it tries to create a scheduled task called `SysMon` as SYSTEM and, if it can't, drops a `sysmon.cmd` in the Startup folder. The code also includes logic for Linux with an `@reboot` entry in the crontab.

![Diagrama de los cuatro pasos de la extensión falsa: código al cargar, llave SSH plantada, túnel inverso y persistencia, más el reporte al atacante y los pasos de limpieza](https://oskydj.sfo3.cdn.digitaloceanspaces.com/calamardo/news_item/2026-10-31/e41-cadena-1eeccf42.png)

It also sends the attacker a report with the hostname, user, operating system, architecture, home folder, working directory, global Git email, public IP and up to 40 environment variable **names** containing `KEY`, `TOKEN`, `SECRET`, `PASS`, `AWS` or `GCP`. Phorion stresses that it sends the names, not the values. Even so, that gives the attacker an inventory of which machines have cloud credentials or API tokens and which ones are worth attacking first.

## The good news (with an asterisk)

The malware has bugs. Phorion found that on macOS the script checks whether remote access is turned off with `systemsetup -getremotelogin` without admin permissions. As a regular user, that command answers with an error message instead of "Off", so the script never tries to turn it on. On Windows, the OpenSSH installation goes through a function that calls `/bin/sh`, which doesn't exist on a standard install.

Cursor reaches the same conclusion: unless you opened the editor with administrator privileges, the step that turns on SSH fails and the attacker couldn't get in through the tunnel. The company also worked with the cloud provider hosting the attacker's server to take it down, so the tunnel and the report no longer go anywhere.

The asterisk: even if the SSH step fails, **the attacker's key did land in your `authorized_keys`, the persistence did get installed and your data was sent**. If your Mac already had Remote Login turned on, or you turn it on later, the door is ready. That's why Cursor asks you to follow the cleanup steps anyway.

## How to tell if you were hit and how to clean up

This applies if you installed or updated to 2.1.312 or 2.1.313 from Cursor's marketplace, on macOS or Windows, within that October 29 window. The quick check Cursor publishes for macOS is:

```
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
```

For Windows there's a PowerShell version in the official notice. If the key shows up, your machine is compromised. Cursor recommends:

- **Isolate the machine** if there's evidence the code ran.
- **Run Cursor's cleanup script**: `remediate-macos.sh` as your user, without root, or `remediate-windows.ps1` as administrator. They remove the extension, the persistence, the tunnel processes and the key.
- **Consider whether to reinstall** the machine from scratch.
- **Rotate credentials and sessions** reachable from that machine, doing it from a trusted computer. Cursor warns that, although the malware only collected variable names, that doesn't rule out someone getting in later through the backdoor.

To clean up by hand, Phorion lists the artifacts: `~/.config/.smt`, `~/.config/.smtk`, the `.stk_*` files in the temp folder, the `com.apple.sysmond` LaunchAgent, the `SysMon` task or the `sysmon.cmd` in Startup, and any `ssh` or `autossh` process with `-R *:0:localhost:22`. If your machine did have SSH enabled, check the login logs: access through the tunnel shows up as if it came from `localhost` using the `svc-telemetry` key. I'm not putting the attacker's IP or the hashes here: they're complete and up to date in the two notices below.

## My take

This case doesn't break any AI model. It breaks trust in the store. VS Code-based editors, like Cursor, have their own marketplaces, and in the Hacker News discussion it became clear that a lot of people assumed that "made by Anthropic" in Cursor's store meant Anthropic had signed that package. This incident shows that it doesn't necessarily: someone with access to the marketplace could publish a version under the official name.

A coding assistant extension is the perfect disguise: it runs with your permissions, sees your code, your terminal and your environment variables, and nobody is surprised when it makes network connections. What this means in practice:

- **Treat extensions like production dependencies**, not like phone apps. If you work on a team, an approved extensions list no longer sounds exaggerated.
- **Turn off automatic updates** for extensions on machines with sensitive credentials, or at least check what changed before accepting a new version.
- **Don't leave production tokens as global environment variables** on your development laptop. That `KEY|TOKEN|SECRET` filter isn't there by accident.
- **Keep an eye on `~/.ssh/authorized_keys`** on your own machine. Almost nobody checks it on a laptop, and that's exactly why it's such a good hiding spot.

Cursor still has to explain how the attacker got in. Until that's known, the uncomfortable question isn't whether the Claude Code extension was there, but which other "official" extension could be next.

## Sources

- [Cursor security notice: malicious versions of Anthropic.claude-code 2.1.312 and 2.1.313](https://cursor.com/blog/claude-code-extension-security-notice)
- [Phorion's technical analysis of the compromised extension](https://phorion.io/blog/offical-claude-code-vsx-compromise/)
- [Felix Rieseberg (Anthropic) comment on Hacker News](https://news.ycombinator.com/item?id=50304129)
- [Hacker News discussion](https://news.ycombinator.com/item?id=50300683)