A malicious version of Anthropic's Claude Code extension was listed on the AI code editor Cursor's marketplace for more than 11 hours, Techzine reported on Oct. 31.

The report said the malicious version tried to install an SSH backdoor on users' PCs that would allow ongoing external access. Up to 5,000 users may have been affected and Cursor took down the entire marketplace as a precaution.

The version in question was Anthropic Claude Code package 2.1.313 and was uploaded to Cursor's extension marketplace on Oct. 29.

Cursor said Claude Code package 2.1.313 was not developed by Anthropic. Cursor is contacting affected users directly to relay details.

Cursor rebuilt the marketplace and resumed service after checking access permissions and replacing security keys. Cursor said other extensions were not tampered with. No evidence has emerged that other versions or official distributions were affected.

The malicious code first collected system information including hostname, username, operating system, Git email address and public IP address. It then registered an attacker SSH key under the name 'svc-telemetry'. It also tried to turn on the local SSH service and open a reverse SSH tunnel to an attacker server. On macOS and Windows, it planted a mechanism to keep that connection alive. A background script tried to reconnect about every 60 seconds.

The actual intrusion appears to have been limited. Turning on SSH requires administrator privileges, and extensions do not have that privilege on most systems. The malicious code also contained errors. Cursor also worked with cloud providers to block the attacker server.