Malicious Claude Code Extension in Cursor: How to Check

A modified Claude Code extension spent about 11 hours in the Cursor marketplace on Oct 29, 2026. Here is how to find out if your machine was hit, and what to do about your code afterward.

• ~11 hours in the marketplace, 2:27 am to 1:35 pm PT
• up to 5,000 users affected, per Cursor's estimate
• 2.1.313 the only version identified as malicious

What happened

According to Cursor's security notice, a tampered build of the extension Anthropic.claude-code, version 2.1.313, was available from about 2:27 am to 1:35 pm PT on Oct 29, 2026. The affected packages are the macOS (arm64) and Windows (x64) builds.

The malicious code does four things:

1. Collects host details. Hostname, username, operating system, home directory, environment variable names, Git email and public IP address.
2. Adds an attacker's SSH key. It tries to write a key labeled svc-telemetry into the authorized_keys file.
3. Opens a reverse SSH tunnel. It tries to keep the tunnel alive after a restart, using a LaunchAgent on macOS or a scheduled task on Windows.
4. Reports back. It sends the collected details to the attacker's server.

Why the damage may be limited. Switching on the SSH service needs admin rights, which the extension does not have on most machines, so the remote login step usually fails. The key, the persistence scripts and the data collection can still succeed, so treat any positive check as a real incident.

Cursor says the attacker's server has been taken offline with the help of the hosting provider. It removed the version, briefly shut the marketplace down, rotated its keys and rebuilt it. Cursor reports no evidence that other extensions, or other versions of this extension, were affected.

Are you affected? How to check

Only people who installed or updated this extension from the Cursor marketplace during the window above are at risk. Run the check for your system. Each one looks for the attacker's SSH key.

macOS (Terminal)

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "key found" || echo "no key found"

Windows (PowerShell)

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "key found" } else { "no key found" }

Cursor also lists other signs to look for:

Where	What to look for
Network	Traffic to 134.209.82.225 on ports 22 and 8099
macOS	A LaunchAgent named com.apple.sysmond
Windows	A scheduled task named SysMon

Found something? Isolate the machine and run the remediation scripts that Cursor provides in its notice. Removing the extension alone is not enough, because the payload leaves its own scripts running.

What to do about your code and credentials

A developer laptop usually has access to source repositories, CI tokens, cloud keys and internal systems. If a machine was affected, the question is what an attacker could reach from it.

1. Rotate credentials used on that machine, from a clean device. Cursor warns that the limited data collected does not rule out later access through the backdoor.
2. List the repositories and pipelines the developer could access during and after the window.
3. Review commits and builds created from that machine in that period. Look for changes nobody can explain.
4. Scan the affected repositories with SAST and SCA, and compare the SBOM of builds made in the window with the previous build. A new or changed dependency is a reason to look closer.

Where DerScanner helps. DerScanner helps with the last two steps: finding unexpected changes in code and dependencies, and producing an SBOM you can compare. It does not detect a backdoor on a laptop. That is the job of your endpoint protection tools.

How to reduce the risk next time

• Treat IDE extensions like dependencies. Keep an approved list, pin versions, and check the publisher and the file hash before rollout.
• Update with a delay. A short wait before accepting new extension versions would avoid an 11-hour exposure like this one.
• Limit admin rights on developer machines. According to Cursor, missing admin rights is the reason the remote login step usually failed.
• Keep secrets out of environment variables on laptops where you can.
• Apply the same control to packages. Blocking suspicious packages at the repository manager (Nexus, JFrog) follows the same principle as an approved extension list. DerScanner 13 can analyze packages at the repository manager.

FAQ

Was this an official Anthropic extension?

No. Cursor states that this version was not developed by Anthropic.

Is the attacker's server still active?

Cursor says it worked with the hosting provider and the server is offline. Check your machine anyway, because the persistence scripts can stay on it.

Does the check also work for VS Code?

The check looks for the attacker's SSH key, so it works on any machine. Cursor's notice covers the Cursor marketplace only.

See what is inside your code and builds

Book a demo and see which components and findings your team has today. Get a demo

Source: Cursor, "Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace," Oct 29, 2026. cursor.com/blog/claude-code-extension-security-notice