A tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor
The extension carried Anthropic's name, but an Anthropic engineer says the company never built or published that copy.
No click was needed: the moment Node loaded the extension, it added an attacker's key labelled "svc-telemetry" to ~/.ssh/authorized_keys and opened a reverse SSH tunnel to an outside server. Uninstalling it doesn't remove the persistence.
Anthropic says someone with access to Cursor's marketplace published the tampered copy, so readers argued over whose incident this is.
What the tampered extension did the moment Node loaded it
Phorion's advisory, published October 30 and updated October 31, describes a backdoor in the Claude Code for VS Code extension as distributed on the Cursor Marketplace. Cursor has removed the affected builds. The original advisory named only version 2.1.313; the update says Cursor identifies 2.1.312 and 2.1.313 as affected on macOS and Windows.
A prefix injected into the extension's bundle runs as soon as Node loads it, with no user interaction. It adds an Ed25519 key labelled "svc-telemetry" to \~/.ssh/authorized_keys, tries to switch on SSH Remote Login, and opens a reverse SSH tunnel to an external server using an embedded key. Persistence is a disguised macOS LaunchAgent, a Linux cron entry, or a Windows scheduled task or Startup script. A beacon reports the hostname, username, public IP and the names (not the values) of environment variables that look like credentials.
On macOS the Remote Login step fails silently for a standard user, which may break the inbound path. The key and persistence still get installed. Phorion's cleanup list: kill the tunnel processes, remove the persistence artifacts and the planted key, confirm Remote Login is off, and rotate credentials if an inbound login turned up.
Anthropic: "this only impacts Cursor users"
Felix Rieseberg, who wrote that he was commenting from Anthropic, drew the boundary early:
"A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected and this only impacts Cursor users."
The thread did not accept the boundary so easily. A commenter replying to that statement pointed at the publisher label:
"Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic."
Others spent the thread reconstructing the plumbing. jitbit, who runs a small self-funded startup, summed up what the incident revealed: Cursor is not using Microsoft's extension library, "apparently" not Open-VSX either, but a marketplace of its own that no one outside can inspect.
Why full-home-directory access made the blast radius so wide
A software engineer and blogger objected to the premise that such an extension needs the run of the machine:
"When you are invited to someone's living room, you don't get to access their bedroom."
One reader put the daily habit in blunt terms:
"everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!"."
The practical question for anyone whose team standardised on a VS Code fork is which registry that fork pulls from and who can publish under an "official" name there. Per jitbit's reading, for Cursor the answer is a private one.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
An observability vendor warns AI incident response will leave SREs unable to fix novel outages
Endoscopists who used AI detected fewer polyps once it was taken away. The essay asks whether on-call engineers face the same drop.