Malicious Claude Code extension on Cursor's marketplace planted an attacker SSH key on developer machines
Cursor said on October 29 that tampered versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were on its marketplace for about 11 hours. They tried to add an attacker SSH key named svc-telemetry, enable SSH and open a reverse tunnel.
Cursor published a security notice on October 29 saying maliciously modified versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were available in its VS Code extension marketplace for Windows and macOS from about 2:27 a.m. to 1:35 p.m. Pacific time that day. Cursor says Anthropic did not develop these versions; neither company has said how they were published. The extension collected the hostname, username, Git email, public IP and the names of environment variables, then tried to add an attacker SSH key with the comment svc-telemetry, enable the local SSH service and open a reverse SSH tunnel, with a LaunchAgent or scheduled task retrying every minute. Cursor says the setup would likely fail without admin rights. It removed the versions, shut the marketplace down, rotated keys and rebuilt it, and found no other extensions tampered with. BleepingComputer put potential exposure at up to 5,000 developers.
Why it matters
The payload did not steal passwords. It tried to add a new identity: an SSH key in authorized_keys is a standing credential that survives password resets, MFA changes and uninstalling the extension. On a developer laptop that also holds cloud sessions, Git tokens and AI provider keys, that is a quiet way back in, the same exposure behind OpenCode and the LiteLLM release.
Search authorized_keys on every Cursor user's machine for svc-telemetry, and use Cursor's IOCs and remediation scripts. If you find it, isolate and consider rebuilding the host, then rotate every credential and session it could reach from a clean device. Longer term, inventory authorized SSH keys as non-human identities with owners, and keep secrets out of developer environment variables.
Source: Cursor
Related on Start with Identity
- BlogApache OFBiz 24.09.08 fixes a hard-coded JWT key, a password reset takeover and default-open REST auth
Apache OFBiz 24.09.08, announced November 4, fixes a batch of authentication flaws: a hard-coded JWT key giving unauthenticated admin access, a password reset f
- BlogChainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached producti
- BlogDreamHost says File Manager attacker took FTP passwords and webmail sessions for about ten weeks
DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of ev
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto
- CVEJFrog Artifactory checks a token's signature and issuer but not its scope
Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin acti
- CVEJFrog Artifactory hands its internal anonymous-user token to unauthenticated callers
Self-hosted Artifactory could return an internal anonymous-user token to an unauthenticated request even with anonymous access disabled. Attackers chained it wi