Overview
- Cursor's VS Code extension marketplace distributed a tampered anthropic.claude-code package for roughly 11 hours on Thursday, Oct. 29, that executed a 66‑line injected loader as soon as the extension loaded.
- The loader appended an attacker SSH public key labelled 'svc-telemetry', attempted to enable SSH, opened a reverse tunnel to 134.209.82.225 and sent host reconnaissance to 134.209.82.225:8099 while installing platform‑specific persistence.
- Cursor removed the malicious build, took its marketplace offline to audit and rotate keys, worked with the hosting provider to take the attacker server offline, and Anthropic published a patched release (v2.1.314) with IOCs and cleanup steps.
- Security firm analysis found coding mistakes in the SSH setup that likely blocked interactive logins on many macOS and Windows hosts, but the backdoor's keys, persistence artifacts and beaconing can survive uninstall and still pose risk.
- Investigators advise isolating affected machines, checking and removing any 'svc-telemetry' entry in authorized_keys, rotating credentials from a clean system and rebuilding compromised hosts while pointing out that mutable registries and auto‑updates make hash pinning an effective defensive practice.